usa	2016-12-27 19:58:14 +0900 (Tue, 27 Dec 2016)

  New Revision: 57219

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=57219

  Log:
    merge revision(s) 57108: [Backport #13049]
    
    sprintf.c: fix width underflow
    
    * sprintf.c (rb_str_format): fix memory corruption by width
      underflow.  https://github.com/mruby/mruby/issues/3347

  Modified directories:
    branches/ruby_2_2/
  Modified files:
    branches/ruby_2_2/ChangeLog
    branches/ruby_2_2/sprintf.c
    branches/ruby_2_2/test/ruby/test_sprintf.rb
    branches/ruby_2_2/version.h
Index: ruby_2_2/ChangeLog
===================================================================
--- ruby_2_2/ChangeLog	(revision 57218)
+++ ruby_2_2/ChangeLog	(revision 57219)
@@ -1,3 +1,8 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_2/ChangeLog#L1
+Tue Dec 27 19:57:51 2016  Nobuyoshi Nakada  <nobu@r...>
+
+	* sprintf.c (rb_str_format): fix memory corruption by width underflow.
+	  https://github.com/mruby/mruby/issues/3347
+
 Tue Dec 27 19:55:10 2016  Nobuyoshi Nakada  <nobu@r...>
 
 	 * re.c (rb_reg_regsub): other than regexp has no name references.
Index: ruby_2_2/test/ruby/test_sprintf.rb
===================================================================
--- ruby_2_2/test/ruby/test_sprintf.rb	(revision 57218)
+++ ruby_2_2/test/ruby/test_sprintf.rb	(revision 57219)
@@ -421,4 +421,9 @@ class TestSprintf < Test::Unit::TestCase https://github.com/ruby/ruby/blob/trunk/ruby_2_2/test/ruby/test_sprintf.rb#L421
       assert_equal(enc, e.message.encoding)
     end
   end
+
+  def test_width_underflow
+    bug = 'https://github.com/mruby/mruby/issues/3347'
+    assert_equal("!", sprintf("%*c", 0, ?!.ord), bug)
+  end
 end
Index: ruby_2_2/sprintf.c
===================================================================
--- ruby_2_2/sprintf.c	(revision 57218)
+++ ruby_2_2/sprintf.c	(revision 57219)
@@ -689,10 +689,10 @@ rb_str_format(int argc, const VALUE *arg https://github.com/ruby/ruby/blob/trunk/ruby_2_2/sprintf.c#L689
 		    CHECK(n);
 		    rb_enc_mbcput(c, &buf[blen], enc);
 		    blen += n;
-		    FILL(' ', width-1);
+		    if (width > 1) FILL(' ', width-1);
 		}
 		else {
-		    FILL(' ', width-1);
+		    if (width > 1) FILL(' ', width-1);
 		    CHECK(n);
 		    rb_enc_mbcput(c, &buf[blen], enc);
 		    blen += n;
Index: ruby_2_2/version.h
===================================================================
--- ruby_2_2/version.h	(revision 57218)
+++ ruby_2_2/version.h	(revision 57219)
@@ -1,6 +1,6 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_2/version.h#L1
 #define RUBY_VERSION "2.2.7"
 #define RUBY_RELEASE_DATE "2016-12-27"
-#define RUBY_PATCHLEVEL 409
+#define RUBY_PATCHLEVEL 410
 
 #define RUBY_RELEASE_YEAR 2016
 #define RUBY_RELEASE_MONTH 12

Property changes on: ruby_2_2
___________________________________________________________________
Modified: svn:mergeinfo
   Merged /trunk:r57108


--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/