From e3d0baa84699dc0fe589fc36e53d09132a0b5925 Mon Sep 17 00:00:00 2001
From: Paul LeoNerd Evans <leonerd@leonerd.org.uk>
Date: Mon, 26 Aug 2013 18:46:01 +0100
Subject: [PATCH] Bugfix to snprint_cameltospaces() when given a short buffer
 [thanks Romain Chossart]

---
 t/11strfkey.c | 11 ++++++++++-
 termkey.c     | 17 ++++++++++++-----
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/t/11strfkey.c b/t/11strfkey.c
index d271ead..36c923e 100644
--- a/t/11strfkey.c
+++ b/t/11strfkey.c
@@ -8,7 +8,7 @@ int main(int argc, char *argv[])
   char       buffer[16];
   size_t     len;
 
-  plan_tests(40);
+  plan_tests(44);
 
   tk = termkey_new_abstract("vt100", 0);
 
@@ -106,6 +106,15 @@ int main(int argc, char *argv[])
   is_int(len, 7, "length for sym/PageUp/0 lowerspace");
   is_str(buffer, "page up", "buffer for sym/PageUp/0 lowerspace");
 
+  /* If size of buffer is too small, strfkey should return something consistent */
+  len = termkey_strfkey(tk, buffer, 4, &key, 0);
+  is_int(len, 6, "length for sym/PageUp/0");
+  is_str(buffer, "Pag", "buffer of len 4 for sym/PageUp/0");
+
+  len = termkey_strfkey(tk, buffer, 4, &key, TERMKEY_FORMAT_LOWERSPACE);
+  is_int(len, 7, "length for sym/PageUp/0 lowerspace");
+  is_str(buffer, "pag", "buffer of len 4 for sym/PageUp/0 lowerspace");
+
   key.type = TERMKEY_TYPE_FUNCTION;
   key.code.number = 5;
   key.modifiers = 0;
diff --git a/termkey.c b/termkey.c
index 20527a3..4239c66 100644
--- a/termkey.c
+++ b/termkey.c
@@ -198,19 +198,26 @@ static int snprint_cameltospaces(char *str, size_t size, const char *src)
 {
   int prev_lower = 0;
   size_t l = 0;
-  while(*src && l < size) {
+  while(*src && l < size - 1) {
     if(isupper(*src) && prev_lower) {
       if(str)
         str[l++] = ' ';
-      if(l >= size)
-        return -1;
+      if(l >= size - 1)
+        break;
     }
     prev_lower = islower(*src);
     str[l++] = tolower(*src++);
   }
-  if(l >= size)
-    return -1;
   str[l] = 0;
+  /* For consistency with snprintf, return the number of bytes that would have
+   * been written, excluding '\0' */
+  while(*src) {
+    if(isupper(*src) && prev_lower) {
+      l++;
+    }
+    prev_lower = islower(*src);
+    src++; l++;
+  }
   return l;
 }