merge revision(s) 54304: [Backport #12223]

	* sprintf.c (rb_str_format): fix buffer overflow, length must be
	  greater than precision.  reported by William Bowling <will AT
	  wbowling.info>.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_3@54505 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

4 files changed, 14 insertions, 4 deletions

diff --git a/ChangeLog b/ChangeLog
index b93af3978d..eaf6631c4f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+Thu Apr  7 01:07:02 2016  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* sprintf.c (rb_str_format): fix buffer overflow, length must be
+	  greater than precision.  reported by William Bowling <will AT
+	  wbowling.info>.
+
 Wed Apr  6 00:33:45 2016  Nobuyoshi Nakada  <nobu@ruby-lang.org>
 
 	* lib/rubygems/security.rb (DIGEST_ALGORITHM, KEY_ALGORITHM):
diff --git a/sprintf.c b/sprintf.c
index 84d5fd112b..a93ba8ffaf 100644
--- a/sprintf.c
+++ b/sprintf.c
@@ -1067,7 +1067,7 @@ rb_str_format(int argc, const VALUE *argv, VALUE fmt)
 		}
 		val = rb_obj_as_string(num);
 		len = RSTRING_LEN(val) + zero;
-		if (prec >= len) ++len; /* integer part 0 */
+		if (prec >= len) len = prec + 1; /* integer part 0 */
 		if (sign || (flags&FSPACE)) ++len;
 		if (prec > 0) ++len; /* period */
 		CHECK(len > width ? len : width);
diff --git a/test/ruby/test_sprintf.rb b/test/ruby/test_sprintf.rb
index 1d3badddf9..66ae4db853 100644
--- a/test/ruby/test_sprintf.rb
+++ b/test/ruby/test_sprintf.rb
@@ -172,6 +172,10 @@ class TestSprintf < Test::Unit::TestCase
     assert_equal("x"*10+"     1.0", sprintf("x"*10+"%8.1f", 1r))
   end
 
+  def test_rational_precision
+    assert_match(/\A0\.\d{600}\z/, sprintf("%.600f", 600**~60))
+  end
+
   def test_hash
     options = {:capture=>/\d+/}
     assert_equal("with options {:capture=>/\\d+/}", sprintf("with options %p" % options))
diff --git a/version.h b/version.h
index 5f435d4a2b..3f06ee7c38 100644
--- a/version.h
+++ b/version.h
@@ -1,10 +1,10 @@
 #define RUBY_VERSION "2.3.0"
-#define RUBY_RELEASE_DATE "2016-04-06"
-#define RUBY_PATCHLEVEL 74
+#define RUBY_RELEASE_DATE "2016-04-07"
+#define RUBY_PATCHLEVEL 75
 
 #define RUBY_RELEASE_YEAR 2016
 #define RUBY_RELEASE_MONTH 4
-#define RUBY_RELEASE_DAY 6
+#define RUBY_RELEASE_DAY 7
 
 #include "ruby/version.h"