nul-terminate bin/ext output in msgpack_object_print_buffer

src/objectc.c

@@ -337,11 +337,15 @@ static int msgpack_object_bin_print_buffer(char *buffer, size_t buffer_size, con
         if (ptr[i] == '"') {
             MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "\\\"");
         } else if (isprint((unsigned char)ptr[i])) {
-            if (aux_buffer_size > 0) {
-                memcpy(aux_buffer, ptr + i, 1);
-                aux_buffer = aux_buffer + 1;
-                aux_buffer_size = aux_buffer_size - 1;
+            // keep room for the terminator, as snprintf does
+            if (aux_buffer_size <= 1) {
+                if (aux_buffer_size == 1) { *aux_buffer = '\0'; }
+                return 0;
             }
+            memcpy(aux_buffer, ptr + i, 1);
+            aux_buffer = aux_buffer + 1;
+            aux_buffer_size = aux_buffer_size - 1;
+            *aux_buffer = '\0';
         } else {
             MSGPACK_CHECKED_CALL(ret, snprintf, aux_buffer, aux_buffer_size, "\\x%02x", (unsigned char)ptr[i]);
         }

test/msgpack_c.cpp

@@ -1651,6 +1651,32 @@ TEST(MSGPACKC, object_bin_print_buffer_overflow) {
   EXPECT_STREQ("\"test\"", buffer);
 }
 
+TEST(MSGPACKC, object_bin_print_buffer_overflow_terminated) {
+  msgpack_object obj;
+  obj.type = MSGPACK_OBJECT_BIN;
+  obj.via.bin.ptr = "test";
+  obj.via.bin.size = 4;
+  char buffer[7];
+
+  for (size_t size = 1; size < sizeof(buffer); ++size) {
+    memset(buffer, 'x', sizeof(buffer));
+    EXPECT_EQ(0, msgpack_object_print_buffer(buffer, size, obj));
+    EXPECT_TRUE(memchr(buffer, '\0', size) != NULL);
+  }
+
+  obj.type = MSGPACK_OBJECT_EXT;
+  obj.via.ext.type = 1;
+  obj.via.ext.ptr = "test";
+  obj.via.ext.size = 4;
+  char ext_buffer[15];
+
+  for (size_t size = 1; size < sizeof(ext_buffer); ++size) {
+    memset(ext_buffer, 'x', sizeof(ext_buffer));
+    EXPECT_EQ(0, msgpack_object_print_buffer(ext_buffer, size, obj));
+    EXPECT_TRUE(memchr(ext_buffer, '\0', size) != NULL);
+  }
+}
+
 TEST(MSGPACKC, init_msgpack_obj_nil) {
     msgpack_object obj;
     msgpack_object_init_nil(&obj);