Fix out of bounds read in printf with trailing '%'

[Algunenano]

Changelog category (leave one):

• Bug Fix (user-visible misbehavior in an official stable release)

Changelog entry (a user-readable short description of the changes that goes into CHANGELOG.md):

Fix out of bounds read in prinft with trailing '%'

Documentation entry for user-facing changes

• Documentation is written (mandatory for new features)

[clickhouse-gh]

Workflow [PR], commit [ed87fe3]

Summary: ❌

job_name	test_name	status	info	comment
Bugfix validation (functional tests)		failure
	04094_printf_trailing_percent	FAIL	cidb	IGNORED

---

AI Review

Summary

This PR updates contrib/fmtlib to ClickHouse/fmt commit 4d9c4a8 (fixing an out-of-bounds read in vprintf for trailing %) and adds stateless regression coverage in 04094_printf_trailing_percent for trailing/escaped % in both constant and materialized format paths. The change is narrowly scoped, includes adversarial boundary cases for the reported issue, and I did not find correctness, safety, or rollout blockers.

ClickHouse Rules

Item	Status	Notes
Deletion logging	➖
Serialization versioning	➖
Core-area scrutiny	✅
No test removal	✅
Experimental gate	➖
No magic constants	✅
Backward compatibility	✅
SettingsChangesHistory.cpp	➖
PR metadata quality	✅
Safe rollout	✅
Compilation time	✅
No large/binary files	✅

Final Verdict

• Status: ✅ Approve

[alexey-milovidov]

@Algunenano, please check this: #97014
So you will not have to ignore the bugfix check.

[clickgapai]

Hi — this PR may need backporting to 25.3, 25.2, 24.8, 24.12, but no backport label was found.

Why: Fixes an out-of-bounds read (MSan finding) in printf that can be triggered by any user query with a trailing percent in the format string. Safe submodule-only change suitable for backport.

Other supported branches (26.3, 26.2, 26.1, 25.8) are not affected — the changed code does not exist there.

If this should be backported, consider adding pr-must-backport or a version-specific label (e.g. v25.3-must-backport). Ignore this if backporting is not applicable.