Permalink
Browse files

The width printf specifier may be negative; fix #3498

  • Loading branch information...
matz committed Mar 11, 2017
1 parent f30ec2d commit 94395e81c1e853fbfd507a0d12e5836a64bf0ce7
Showing with 9 additions and 6 deletions.
  1. +9 −6 mrbgems/mruby-sprintf/src/sprintf.c
@@ -116,6 +116,7 @@ mrb_fix2binstr(mrb_state *mrb, mrb_value x, int base)
#define CHECK(l) do {\
/* int cr = ENC_CODERANGE(result);*/\
if ((l) < 0) mrb_raise(mrb, E_ARGUMENT_ERROR, "illegal specifier"); \
while ((l) >= bsiz - blen) {\
bsiz*=2;\
if (bsiz < 0) mrb_raise(mrb, E_ARGUMENT_ERROR, "too big specifier"); \
@@ -766,7 +767,7 @@ mrb_str_format(mrb_state *mrb, int argc, const mrb_value *argv, mrb_value fmt)
width -= (int)slen;
if (!(flags&FMINUS)) {
CHECK(width);
while (width--) {
while (width-- > 0) {
buf[blen++] = ' ';
}
}
@@ -775,7 +776,7 @@ mrb_str_format(mrb_state *mrb, int argc, const mrb_value *argv, mrb_value fmt)
blen += len;
if (flags&FMINUS) {
CHECK(width);
while (width--) {
while (width-- > 0) {
buf[blen++] = ' ';
}
}
@@ -982,7 +983,7 @@ mrb_str_format(mrb_state *mrb, int argc, const mrb_value *argv, mrb_value fmt)
width -= prec;
}
if (!(flags&FMINUS)) {
if (!(flags&FMINUS) && width > 0) {
CHECK(width);
while (width-- > 0) {
buf[blen++] = ' ';
@@ -1012,9 +1013,11 @@ mrb_str_format(mrb_state *mrb, int argc, const mrb_value *argv, mrb_value fmt)
}
PUSH(s, len);
CHECK(width);
while (width-- > 0) {
buf[blen++] = ' ';
if (width > 0) {
CHECK(width);
while (width-- > 0) {
buf[blen++] = ' ';
}
}
}
break;

0 comments on commit 94395e8

Please sign in to comment.