aboutsummaryrefslogtreecommitdiffstats
path: root/sprintf.c
diff options
context:
space:
mode:
authornobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2016-03-27 23:18:52 +0000
committernobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2016-03-27 23:18:52 +0000
commit21ed0e933bea698c7c8ab56590fa0469c7a6d099 (patch)
tree305ab7c3b2fff3a65b3f2ea3f40392f3c1835dd6 /sprintf.c
parent2ee07d60d43fa761b1ebb5e65350bafe34b124a5 (diff)
downloadruby-21ed0e933bea698c7c8ab56590fa0469c7a6d099.tar.gz
sprintf.c: fix buffer overflow
* sprintf.c (rb_str_format): fix buffer overflow, length must be greater than precision. reported by William Bowling <will AT wbowling.info>. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@54304 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'sprintf.c')
-rw-r--r--sprintf.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/sprintf.c b/sprintf.c
index 5c1f7780f0..d67ffff08c 100644
--- a/sprintf.c
+++ b/sprintf.c
@@ -1070,7 +1070,7 @@ rb_str_format(int argc, const VALUE *argv, VALUE fmt)
}
val = rb_int2str(num, 10);
len = RSTRING_LEN(val) + zero;
- if (prec >= len) ++len; /* integer part 0 */
+ if (prec >= len) len = prec + 1; /* integer part 0 */
if (sign || (flags&FSPACE)) ++len;
if (prec > 0) ++len; /* period */
CHECK(len > width ? len : width);