summaryrefslogtreecommitdiff
path: root/sprintf.c
diff options
context:
space:
mode:
authornobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2016-03-27 23:18:52 (GMT)
committernobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2016-03-27 23:18:52 (GMT)
commit9ae4c2d59098ce6158385dda2539d2b36a03c090 (patch)
tree305ab7c3b2fff3a65b3f2ea3f40392f3c1835dd6 /sprintf.c
parentd1e2d6a9c52749912e8239d51b6beb5c6d9de943 (diff)
sprintf.c: fix buffer overflow
* sprintf.c (rb_str_format): fix buffer overflow, length must be greater than precision. reported by William Bowling <will AT wbowling.info>. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@54304 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'sprintf.c')
-rw-r--r--sprintf.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/sprintf.c b/sprintf.c
index 5c1f778..d67ffff 100644
--- a/sprintf.c
+++ b/sprintf.c
@@ -1070,7 +1070,7 @@ rb_str_format(int argc, const VALUE *argv, VALUE fmt)
}
val = rb_int2str(num, 10);
len = RSTRING_LEN(val) + zero;
- if (prec >= len) ++len; /* integer part 0 */
+ if (prec >= len) len = prec + 1; /* integer part 0 */
if (sign || (flags&FSPACE)) ++len;
if (prec > 0) ++len; /* period */
CHECK(len > width ? len : width);