sprintf.c: fix width underflow

* sprintf.c (rb_str_format): fix memory corruption by width
  underflow.  https://github.com/mruby/mruby/issues/3347

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@57108 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

2 files changed, 7 insertions, 2 deletions

diff --git a/sprintf.c b/sprintf.c
index 5884926b3e..4342904bdc 100644
--- a/sprintf.c
+++ b/sprintf.c
@@ -705,10 +705,10 @@ rb_str_format(int argc, const VALUE *argv, VALUE fmt)
 		    CHECK(n);
 		    rb_enc_mbcput(c, &buf[blen], enc);
 		    blen += n;
-		    FILL(' ', width-1);
+		    if (width > 1) FILL(' ', width-1);
 		}
 		else {
-		    FILL(' ', width-1);
+		    if (width > 1) FILL(' ', width-1);
 		    CHECK(n);
 		    rb_enc_mbcput(c, &buf[blen], enc);
 		    blen += n;
diff --git a/test/ruby/test_sprintf.rb b/test/ruby/test_sprintf.rb
index df9b19b064..595bf6d782 100644
--- a/test/ruby/test_sprintf.rb
+++ b/test/ruby/test_sprintf.rb
@@ -446,4 +446,9 @@ class TestSprintf < Test::Unit::TestCase
     h = { key: nil, key2: "key2_val" }
     assert_equal("key is , key2 is key2_val", "key is %{key}, key2 is %{key2}" % h)
   end
+
+  def test_width_underflow
+    bug = 'https://github.com/mruby/mruby/issues/3347'
+    assert_equal("!", sprintf("%*c", 0, ?!.ord), bug)
+  end
 end