mirror of
				https://github.com/ruby/ruby.git
				synced 2022-11-09 12:17:21 -05:00 
			
		
		
		
	sprintf.c: fix width underflow
* sprintf.c (rb_str_format): fix memory corruption by width underflow. https://github.com/mruby/mruby/issues/3347 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@57108 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
		
							parent
							
								
									e03c771d1c
								
							
						
					
					
						commit
						0854193a68
					
				
					 2 changed files with 7 additions and 2 deletions
				
			
		| 
						 | 
					@ -705,10 +705,10 @@ rb_str_format(int argc, const VALUE *argv, VALUE fmt)
 | 
				
			||||||
		    CHECK(n);
 | 
							    CHECK(n);
 | 
				
			||||||
		    rb_enc_mbcput(c, &buf[blen], enc);
 | 
							    rb_enc_mbcput(c, &buf[blen], enc);
 | 
				
			||||||
		    blen += n;
 | 
							    blen += n;
 | 
				
			||||||
		    FILL(' ', width-1);
 | 
							    if (width > 1) FILL(' ', width-1);
 | 
				
			||||||
		}
 | 
							}
 | 
				
			||||||
		else {
 | 
							else {
 | 
				
			||||||
		    FILL(' ', width-1);
 | 
							    if (width > 1) FILL(' ', width-1);
 | 
				
			||||||
		    CHECK(n);
 | 
							    CHECK(n);
 | 
				
			||||||
		    rb_enc_mbcput(c, &buf[blen], enc);
 | 
							    rb_enc_mbcput(c, &buf[blen], enc);
 | 
				
			||||||
		    blen += n;
 | 
							    blen += n;
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
| 
						 | 
					@ -446,4 +446,9 @@ class TestSprintf < Test::Unit::TestCase
 | 
				
			||||||
    h = { key: nil, key2: "key2_val" }
 | 
					    h = { key: nil, key2: "key2_val" }
 | 
				
			||||||
    assert_equal("key is , key2 is key2_val", "key is %{key}, key2 is %{key2}" % h)
 | 
					    assert_equal("key is , key2 is key2_val", "key is %{key}, key2 is %{key2}" % h)
 | 
				
			||||||
  end
 | 
					  end
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					  def test_width_underflow
 | 
				
			||||||
 | 
					    bug = 'https://github.com/mruby/mruby/issues/3347'
 | 
				
			||||||
 | 
					    assert_equal("!", sprintf("%*c", 0, ?!.ord), bug)
 | 
				
			||||||
 | 
					  end
 | 
				
			||||||
end
 | 
					end
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
		Loading…
	
	Add table
		Add a link
		
	
		Reference in a new issue