fix heap-buffer-overflow

[zhangtaoXT5]

fix heap-buffer-overflow in #956

[michael-grunder]

Hi,

I'm going through PRs in preparation for a new release. I see what you're fixing here, but can you provide an example format string where we would currently read past the end of the buffer?

I think a regression test may be worthwhile.

[bjosv]

I ran the fuzzing tests described in the issue to be able to propose a testcase.
I have pinpointed the problem to the format specifier parser and will push an alternative fix for this, together with the testcases.

[michael-grunder]

Closing in favor of #1097. Thanks for finding and reporting the issue though!

[kristjanvalur]

I contest closing this. Incrementing a zero terminated string twice, without checking that there is indeed a zero in between increments, is dangerous. One should always check for zeroes, even if one strongly believes that the string is correctly constructed.

It is prudent, from a security perspective, to leave no opening for reading past the end of a string. Even if one has good faith that the string is well formed.

[kristjanvalur]

I'd change this to break to make the intention more explicit.

[gzur]

I am a professional programmer and I approve of this message.

[michael-grunder]

@kristjanvalur I see your point. It certainly doesn't hurt anything to apply both fixes.