Avoid integer overflow in sprintf()

merged ff03a9a61c

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58034 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

sprintf.c

@@ -55,8 +55,9 @@ sign_bits(int base, const char *p)
 
 #define CHECK(l) do {\
     int cr = ENC_CODERANGE(result);\
-    while (blen + (l) >= bsiz) {\
+    while ((l) >= bsiz - blen) {\
 	bsiz*=2;\
+	if (bsiz<0) rb_raise(rb_eArgError, "too big specifier");\
     }\
     rb_str_resize(result, bsiz);\
     ENC_CODERANGE_SET(result, cr);\