printf: arithmetic overflow (overflow-checks) on a `%*d` dynamic field width of `i64::MIN`

[leeewee]

printf's %* dynamic field width takes the width from an argument (printf '%*d' <width> <value>). For a negative width, resolve_asterisk_width computes -(nb as isize) to get the magnitude.

coreutils/src/uucore/src/lib/features/format/spec.rs

Lines 505 to 521 in 21d4e96

	fn resolve_asterisk_width(
	option: Option<CanAsterisk<usize>>,
	args: &mut FormatArguments,
	) -> Option<(usize, bool)> {
	match option {
	None => None,
	Some(CanAsterisk::Asterisk(loc)) => {
	let nb = args.next_i64(loc);
	if nb < 0 {
	Some((usize::try_from(-(nb as isize)).ok().unwrap_or(0), true))
	} else {
	Some((usize::try_from(nb).ok().unwrap_or(0), false))
	}
	}
	Some(CanAsterisk::Fixed(w)) => Some((w, false)),
	}
	}

When the width argument is i64::MIN (-9223372036854775808), nb as isize is isize::MIN, and negating it overflows (it has no positive counterpart), panicking with attempt to negate with overflow under -C overflow-checks (exit 134).

$ printf '%*d' -9223372036854775808 1
thread 'main' panicked at src/uucore/src/lib/features/format/spec.rs:520:39:
attempt to negate with overflow
$ echo $?
134

[Xylphy]

Fixing that function will still result to an error due to width having a limit.

coreutils/src/uucore/src/lib/features/format/mod.rs

Lines 130 to 147 in c98a5dc

	/// Maximum width for formatting to prevent memory allocation panics.
	/// Rust's formatter will panic when trying to allocate memory for very large widths.
	/// This limit is somewhat arbitrary but should be well above any practical use case
	/// while still preventing formatter panics.
	const MAX_FORMAT_WIDTH: usize = 1_000_000;
	/// Check if a width is too large for formatting.
	/// Returns an error if the width exceeds MAX_FORMAT_WIDTH.
	fn check_width(width: usize) -> std::io::Result<()> {
	if width > MAX_FORMAT_WIDTH {
	Err(std::io::Error::new(
	std::io::ErrorKind::OutOfMemory,
	"formatting width too large",
	))
	} else {
	Ok(())
	}
	}

Removing such limit will result to another error Formatting argument out of range, same with #13735. I don't know what will be the correct action for this one (e.g. removing the limit then make another issue for formatting range error).