`printf` panics on precision > 65535, leaking stack backtrace

[chaliy]

Summary

printf "%.65536f" 1.0 triggers a thread panic in Rust's format! macro because the precision value exceeds u16 max (65535). No bounds check exists before passing user-controlled precision to format!. The panic dumps a full stack backtrace to stderr, leaking internal file paths and dependency versions.

Severity: Medium
Category: DoS / Information Disclosure (TM-DOS / TM-INT)

Affected Files

• crates/bashkit/src/builtins/printf.rs line 382

Steps to Reproduce

printf "%.65536f" 1.0
# Thread panics with:
# thread 'main' panicked at 'Formatting argument out of range'
# Full backtrace with internal paths leaked to stderr

Impact

• Crash: Interpreter thread panics on attacker-controlled input
• Information disclosure: Stack backtrace reveals internal source paths (./crates/bashkit/src/builtins/printf.rs:382:37), cargo registry paths, dependency versions (tokio, anyhow versions), and function names

Acceptance Criteria

• Clamp fmt_spec.precision to maximum 65535 (or lower, e.g., 10000) before the format! call
• No panic on any user-controlled precision value
• Test: printf "%.99999f" 1.0 returns graceful error or clamped output
• Test: printf "%.100f" 1.0 still works correctly