merge revision(s) 54304: [Backport #12223]

	* sprintf.c (rb_str_format): fix buffer overflow, length must be
	  greater than precision.  reported by William Bowling <will AT
	  wbowling.info>.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_2@54443 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

4 files changed, 12 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 5c2fefcfe4..f5998e2111 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+Thu Mar 31 05:06:02 2016  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* sprintf.c (rb_str_format): fix buffer overflow, length must be
+	  greater than precision.  reported by William Bowling <will AT
+	  wbowling.info>.
+
 Thu Mar 31 04:49:05 2016  Kimura Wataru  <kimuraw@i.nifty.jp>
 
 	* test/ruby/test_io.rb: handled rlimit value same as r52277
diff --git a/sprintf.c b/sprintf.c
index 355b4adf00..80829a871c 100644
--- a/sprintf.c
+++ b/sprintf.c
@@ -1055,7 +1055,7 @@ rb_str_format(int argc, const VALUE *argv, VALUE fmt)
 		}
 		val = rb_obj_as_string(num);
 		len = RSTRING_LEN(val) + zero;
-		if (prec >= len) ++len; /* integer part 0 */
+		if (prec >= len) len = prec + 1; /* integer part 0 */
 		if (sign || (flags&FSPACE)) ++len;
 		if (prec > 0) ++len; /* period */
 		CHECK(len > width ? len : width);
diff --git a/test/ruby/test_sprintf.rb b/test/ruby/test_sprintf.rb
index cfac7efa92..ff4f9a5631 100644
--- a/test/ruby/test_sprintf.rb
+++ b/test/ruby/test_sprintf.rb
@@ -171,6 +171,10 @@ class TestSprintf < Test::Unit::TestCase
     assert_equal("x"*10+"     1.0", sprintf("x"*10+"%8.1f", 1r))
   end
 
+  def test_rational_precision
+    assert_match(/\A0\.\d{600}\z/, sprintf("%.600f", 600**~60))
+  end
+
   def test_hash
     options = {:capture=>/\d+/}
     assert_equal("with options {:capture=>/\\d+/}", sprintf("with options %p" % options))
diff --git a/version.h b/version.h
index 12eb89296c..10b5108260 100644
--- a/version.h
+++ b/version.h
@@ -1,6 +1,6 @@
 #define RUBY_VERSION "2.2.5"
 #define RUBY_RELEASE_DATE "2016-03-31"
-#define RUBY_PATCHLEVEL 291
+#define RUBY_PATCHLEVEL 292
 
 #define RUBY_RELEASE_YEAR 2016
 #define RUBY_RELEASE_MONTH 3