nobu	2016-12-18 03:04:30 +0900 (Sun, 18 Dec 2016)

  New Revision: 57108

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=57108

  Log:
    sprintf.c: fix width underflow
    
    * sprintf.c (rb_str_format): fix memory corruption by width
      underflow.  https://github.com/mruby/mruby/issues/3347

  Modified files:
    trunk/sprintf.c
    trunk/test/ruby/test_sprintf.rb
Index: sprintf.c
===================================================================
--- sprintf.c	(revision 57107)
+++ sprintf.c	(revision 57108)
@@ -705,10 +705,10 @@ rb_str_format(int argc, const VALUE *arg https://github.com/ruby/ruby/blob/trunk/sprintf.c#L705
 		    CHECK(n);
 		    rb_enc_mbcput(c, &buf[blen], enc);
 		    blen += n;
-		    FILL(' ', width-1);
+		    if (width > 1) FILL(' ', width-1);
 		}
 		else {
-		    FILL(' ', width-1);
+		    if (width > 1) FILL(' ', width-1);
 		    CHECK(n);
 		    rb_enc_mbcput(c, &buf[blen], enc);
 		    blen += n;
Index: test/ruby/test_sprintf.rb
===================================================================
--- test/ruby/test_sprintf.rb	(revision 57107)
+++ test/ruby/test_sprintf.rb	(revision 57108)
@@ -446,4 +446,9 @@ class TestSprintf < Test::Unit::TestCase https://github.com/ruby/ruby/blob/trunk/test/ruby/test_sprintf.rb#L446
     h = { key: nil, key2: "key2_val" }
     assert_equal("key is , key2 is key2_val", "key is %{key}, key2 is %{key2}" % h)
   end
+
+  def test_width_underflow
+    bug = 'https://github.com/mruby/mruby/issues/3347'
+    assert_equal("!", sprintf("%*c", 0, ?!.ord), bug)
+  end
 end

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/