possible buffer overrun in Curl_infof

[yiyuaner]

In the file lib/sendf.c, the function Curl_infof has the following code:

void Curl_infof(struct Curl_easy *data, const char *fmt, ...) {
    ...
    size_t len;
    char buffer[MAXINFO + 2];
    len = mvsnprintf(buffer, MAXINFO, fmt, ap);
    buffer[len++] = '\n';
}

Since the function mvsnprintf may return -1 (see the code here), the following buffer access buffer[len++] can trigger a buffer overrun.

Similarly, the code for Curl_failf may trigger buffer overrun too:

void Curl_failf(struct Curl_easy *data, const char *fmt, ...) {
    size_t len;
    char error[CURL_ERROR_SIZE + 2];
    len = mvsnprintf(error, CURL_ERROR_SIZE, fmt, ap);
    error[len++] = '\n';
}

[bagder]

It is indeed an error, but luckily I think dprintf_formatf never actually returns -1 inside libcurl so this error never happens. Should still fix of course.