udebug: fix double off-by-one in udebug_entry_vprintf()

Two off-by-one errors cause silent string truncation:

1. The check after the first vsnprintf uses <= instead of <. When the
   output needs exactly UDEBUG_MIN_ALLOC_LEN chars, vsnprintf returns
   that count to indicate truncation, but the <= condition skips the
   reallocation path, silently using the truncated result.

2. After reallocating len+1 bytes, the second vsnprintf is called with
   len as the size limit. Since vsnprintf writes at most size-1 chars
   plus a null terminator, the last character is always lost. Pass
   len+1 to use the full allocated buffer.

Link: https://github.com/openwrt/libubox/pull/42
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 406e342bb900cda5ce56481895db85a86a8f5dd7)

1 files changed, 2 insertions, 2 deletions

diff --git a/udebug.c b/udebug.c
index e39a32c..1b43f69 100644
--- a/udebug.c
+++ b/udebug.c
@@ -625,14 +625,14 @@ int udebug_entry_vprintf(struct udebug_buf *buf, const char *fmt, va_list ap)
 	va_copy(ap2, ap);
 	len = vsnprintf(str, UDEBUG_MIN_ALLOC_LEN, fmt, ap2);
 	va_end(ap2);
-	if (len <= UDEBUG_MIN_ALLOC_LEN)
+	if (len < UDEBUG_MIN_ALLOC_LEN)
 		goto out;
 
 	if (ptr->len + len > buf->data_size / 2)
 		return -1;
 
 	udebug_buf_alloc(buf, ofs, len + 1);
-	len = vsnprintf(str, len, fmt, ap);
+	len = vsnprintf(str, len + 1, fmt, ap);
 
 out:
 	ptr->len += len;