Segfault in mrb_str_format

[clayton-shopify]

The following input causes a segfault in mrb_str_format:

sprintf("%1$*c", 0)

This issue was reported by https://hackerone.com/haquaman, who suggested the following patch:

diff --git a/mrbgems/mruby-sprintf/src/sprintf.c b/mrbgems/mruby-sprintf/src/sprintf.c
index 696d093..30adbb0 100644
--- a/mrbgems/mruby-sprintf/src/sprintf.c
+++ b/mrbgems/mruby-sprintf/src/sprintf.c
@@ -687,10 +687,10 @@ retry:
           CHECK(n);
           memcpy(buf+blen, c, n);
           blen += n;
-          FILL(' ', width-1);
+          if (width) FILL(' ', width-1);
         }
         else {
-          FILL(' ', width-1);
+          if (width) FILL(' ', width-1);
           CHECK(n);
           memcpy(buf+blen, c, n);
           blen += n;

[matz]

CRuby causes an exceptoin for the format string.

unnumbered(1) mixed with numbered (ArgumentError)