The argv length calculation was not only off by one, but failed to take

into account the extra space required by expanded quotes, backslashes and
newlines.  Instead of pre-allocating a (possibly too short) buffer, start
with a 64-byte buffer and double it every time we come close to filling
it up.  Also, avoid appending a trailing space before the final newline.

This issue was uncovered by Kristoffer Gleditsch <kristoffer@linpro.no>,
who also helped test this patch.

git-svn-id: http://www.varnish-cache.org/svn/trunk/varnish-cache@1287 d4fa192b-c00b-0410-8231-f00ffab90ce4

bin/varnishd/mgt_cli.c

@@ -95,14 +95,23 @@ mcf_passthru(struct cli *cli, char **av, void *priv)
 		cli_out(cli, "Cache process not running");
 		return;
 	}
-	v = 0;
-	for (u = 1; av[u] != NULL; u++)
-		v += strlen(av[u]) + 3;
+	v = 64;
 	p = malloc(v);
 	XXXAN(p);
 	q = p;
 	for (u = 1; av[u] != NULL; u++) {
+		if (v < (q - p) + 8) {
+			r = realloc(p, v + v);
+			XXXAN(r);
+			v += v;
+			q += r - p;
+			p = r;
+		}
+		/* v >= (q - p) + 8 */
+		if (u > 1)
+			*q++ = ' ';
 		*q++ = '"';
+		/* v >= (q - p) + 6 */
 		for (r = av[u]; *r; r++) {
 			switch (*r) {
 			case '\\':	*q++ = '\\'; *q++ = '\\'; break;
@@ -111,9 +120,10 @@ mcf_passthru(struct cli *cli, char **av, void *priv)
 			default:	*q++ = *r; break;
 			}
 		}
+		/* v >= (q - p) + 4 */
 		*q++ = '"';
-		*q++ = ' ';
 	}
+	/* v >= (q - p) + 3 */
 	*q++ = '\n';
 	v = q - p;
 	i = write(cli_o, p, v);