diff options
| -rw-r--r-- | sprintf.c | 1 | ||||
| -rw-r--r-- | test/ruby/test_sprintf.rb | 6 |
2 files changed, 7 insertions, 0 deletions
@@ -648,6 +648,7 @@ rb_str_format(int argc, const VALUE *argv, VALUE fmt) if (width < 0) { flags |= FMINUS; width = -width; + if (width < 0) rb_raise(rb_eArgError, "width too big"); } p++; goto retry; diff --git a/test/ruby/test_sprintf.rb b/test/ruby/test_sprintf.rb index f58686d93d..df004305ec 100644 --- a/test/ruby/test_sprintf.rb +++ b/test/ruby/test_sprintf.rb @@ -514,6 +514,12 @@ class TestSprintf < Test::Unit::TestCase assert_equal("!", sprintf("%*c", 0, ?!.ord), bug) end + def test_negative_width_overflow + assert_raise_with_message(ArgumentError, /too big/) do + sprintf("%*s", RbConfig::LIMITS["INT_MIN"], "") + end + end + def test_no_hidden_garbage fmt = [4, 2, 2].map { |x| "%0#{x}d" }.join('-') # defeats optimization ObjectSpace.count_objects(res = {}) # creates strings on first call |