Fix potential infinite loop in snprintf() emulation code (STR #25)

CHANGES

@@ -1,8 +1,10 @@
-CHANGES - 08/05/2005
+CHANGES - 08/10/2005
 --------------------
 
 CHANGES IN Mini-XML 2.2.4
 
+	- The mxml_vsnprintf() function could get in an infinite
+	  loop on a buffer overflow (STR #25)
 	- Added new mxmlNewCDATA() and mxmlSetCDATA() functions
 	  to create and set CDATA nodes, which are really just
 	  special element nodes.

README

@@ -1,11 +1,11 @@
-README - 05/19/2005
+README - 08/10/2005
 -------------------
 
 
 INTRODUCTION
 
     This README file describes the Mini-XML library version
-    2.2.2.
+    2.2.4.
 
     Mini-XML is a small XML parsing library that you can use to
     read XML and XML-like data files in your application without

doc/relnotes.html

@@ -3,18 +3,22 @@
 
 <h1 align='right'><a name='RELNOTES'>B - Release Notes</a></h1>
 
-<h2>Changes in Mini-XML 2.2.3</h2>
+<h2>Changes in Mini-XML 2.2.4</h2>
 
 <ul>
 
+	<li>The mxml_vsnprintf() function could get in an infinite
+	loop on a buffer overflow (STR #25)</li>
+
 	<li>Added new mxmlNewCDATA() and mxmlSetCDATA() functions
 	to create and set CDATA nodes, which are really just
 	special element nodes.</li>
 
+
 </ul>
 
 
-<h2>Changes in Mini-XML 2.2.2</h2>
+<h2>Changes in Mini-XML 2.2.3</h2>
 
 <ul>
 
@@ -28,6 +32,16 @@
 </ul>
 
 
+<h2>Changes in Mini-XML 2.2.2</h2>
+
+<ul>
+
+	<li>mxmlLoad*() did not treat custom data as opaque, so
+	whitespace characters would be lost.</li>
+
+</ul>
+
+
 <h2>Changes in Mini-XML 2.2.1</h2>
 
 <ul>

mxml-string.c

@@ -383,7 +383,9 @@ mxml_vsnprintf(char       *buffer,	/* O - Output buffer */
       bytes ++;
 
       if (bufptr && bufptr < bufend)
-	*bufptr++ = *format++;
+	*bufptr++ = *format;
+
+      format ++;
     }
   }