Hanno Böck authored Feb 22, 2016 and Allison Karlitskaya committed Feb 22, 2016

The scanning to find the end of a positional parameter designator in
GVariant text format (e.g. '%i') is currently broken in case the 'end'
pointer is not specified.

The scan is controlled by a somewhat complicated loop that needs to deal
properly with cases like (123, %(ii)) [where '%(ii)' is to be taken
together, but the final ')' not].

This loop missed the case where a format string passed to
g_variant_new_parsed() ended immediately after such a conversion, with a
nul character.  In this case the 'end' pointer is NULL, so the only way
we can find the end is by scanning for nul in the string.

In case of g_variant_new_parsed() [which is what this code was designed
to be used for], the bug is somewhat unlikely in practice: the only way
that a valid text-form GVariant could ever contain a positional
parameter replacement at the end of the string is if this positional
parameter were the only thing being returned.  In that case, the user
would likely have o...