nobu	2017-03-13 23:59:08 +0900 (Mon, 13 Mar 2017)

  New Revision: 57962

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=57962

  Log:
    sprintf.c: fix out-of-bound access
    
    * sprintf.c (rb_str_format): get rid of out-of-bound access when
      single % at the end.

  Modified files:
    trunk/sprintf.c
Index: sprintf.c
===================================================================
--- sprintf.c	(revision 57961)
+++ sprintf.c	(revision 57962)
@@ -517,6 +517,7 @@ rb_str_format(int argc, const VALUE *arg https://github.com/ruby/ruby/blob/trunk/sprintf.c#L517
 	VALUE sym = Qnil;
 
 	for (t = p; t < end && *t != '%'; t++) ;
+	if (t + 1 == end) ++t;
 	PUSH(p, t - p);
 	if (coderange != ENC_CODERANGE_BROKEN && scanned < blen) {
 	    scanned += rb_str_coderange_scan_restartable(buf+scanned, buf+blen, enc, &coderange);

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/