merge revision(s) 57108: [Backport #13121]

	sprintf.c: fix width underflow

	* sprintf.c (rb_str_format): fix memory corruption by width
  underflow.  https://github.com/mruby/mruby/issues/3347

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_3@57340 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

3 files changed, 12 insertions, 7 deletions

diff --git a/sprintf.c b/sprintf.c
index b022c5decc..6c49fe07b6 100644
--- a/sprintf.c
+++ b/sprintf.c
@@ -697,10 +697,10 @@ rb_str_format(int argc, const VALUE *argv, VALUE fmt)
 		    CHECK(n);
 		    rb_enc_mbcput(c, &buf[blen], enc);
 		    blen += n;
-		    FILL(' ', width-1);
+		    if (width > 1) FILL(' ', width-1);
 		}
 		else {
-		    FILL(' ', width-1);
+		    if (width > 1) FILL(' ', width-1);
 		    CHECK(n);
 		    rb_enc_mbcput(c, &buf[blen], enc);
 		    blen += n;
diff --git a/test/ruby/test_sprintf.rb b/test/ruby/test_sprintf.rb
index 8aa0cbfea5..f94d38d510 100644
--- a/test/ruby/test_sprintf.rb
+++ b/test/ruby/test_sprintf.rb
@@ -433,4 +433,9 @@ class TestSprintf < Test::Unit::TestCase
     h = { key: nil, key2: "key2_val" }
     assert_equal("key is , key2 is key2_val", "key is %{key}, key2 is %{key2}" % h)
   end
+
+  def test_width_underflow
+    bug = 'https://github.com/mruby/mruby/issues/3347'
+    assert_equal("!", sprintf("%*c", 0, ?!.ord), bug)
+  end
 end
diff --git a/version.h b/version.h
index 6657436a29..760766a397 100644
--- a/version.h
+++ b/version.h
@@ -1,10 +1,10 @@
 #define RUBY_VERSION "2.3.3"
-#define RUBY_RELEASE_DATE "2016-11-24"
-#define RUBY_PATCHLEVEL 224
+#define RUBY_RELEASE_DATE "2017-01-17"
+#define RUBY_PATCHLEVEL 225
 
-#define RUBY_RELEASE_YEAR 2016
-#define RUBY_RELEASE_MONTH 11
-#define RUBY_RELEASE_DAY 24
+#define RUBY_RELEASE_YEAR 2017
+#define RUBY_RELEASE_MONTH 1
+#define RUBY_RELEASE_DAY 17
 
 #include "ruby/version.h"