nobu	2017-07-23 18:44:48 +0900 (Sun, 23 Jul 2017)

  New Revision: 59410

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=59410

  Log:
    sprintf.c: width too big
    
    * sprintf.c (rb_str_format): explicitly reject too big negative
      width, instead of an empty string.

  Modified files:
    trunk/sprintf.c
    trunk/test/ruby/test_sprintf.rb
Index: test/ruby/test_sprintf.rb
===================================================================
--- test/ruby/test_sprintf.rb	(revision 59409)
+++ test/ruby/test_sprintf.rb	(revision 59410)
@@ -514,6 +514,12 @@ class TestSprintf < Test::Unit::TestCase https://github.com/ruby/ruby/blob/trunk/test/ruby/test_sprintf.rb#L514
     assert_equal("!", sprintf("%*c", 0, ?!.ord), bug)
   end
 
+  def test_negative_width_overflow
+    assert_raise_with_message(ArgumentError, /too big/) do
+      sprintf("%*s", RbConfig::LIMITS["INT_MIN"], "")
+    end
+  end
+
   def test_no_hidden_garbage
     fmt = [4, 2, 2].map { |x| "%0#{x}d" }.join('-') # defeats optimization
     ObjectSpace.count_objects(res = {}) # creates strings on first call
Index: sprintf.c
===================================================================
--- sprintf.c	(revision 59409)
+++ sprintf.c	(revision 59410)
@@ -648,6 +648,7 @@ rb_str_format(int argc, const VALUE *arg https://github.com/ruby/ruby/blob/trunk/sprintf.c#L648
 	    if (width < 0) {
 		flags |= FMINUS;
 		width = -width;
+		if (width < 0) rb_raise(rb_eArgError, "width too big");
 	    }
 	    p++;
 	    goto retry;

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/