We set buffer->pos to buffer->end in function buffer_print() when bvsnprintf() failed, so there would be uninitialized memory between the old buffer->pos and the current buffer->pos.