From ca181afb8e75fda4d04ec3201f3796407b683cbf Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Fri, 21 Aug 2026 12:46:40 -0400 Subject: [PATCH] Fix unbounded write on negative star precision in format_converter A "%.*[diouxX]" conversion with a negative precision was only clamped to -1, which FIX_PRECISION() compares against a size_t: (size_t)-1 turns the zero-padding loop into an unbounded backward write through num_buf and the stack. Treat a negative star precision as omitted in format_converter() only; xbuf_format_converter() keeps -1 as the %H shortest-float sentinel used by serialize_precision. --- main/snprintf.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/main/snprintf.c b/main/snprintf.c index 78aa6cc3a8db..c387eaf46cac 100644 --- a/main/snprintf.c +++ b/main/snprintf.c @@ -580,8 +580,10 @@ static size_t format_converter(buffy * odp, const char *fmt, va_list ap) /* {{{ } else if (*fmt == '*') { precision = va_arg(ap, int); fmt++; - if (precision < -1) - precision = -1; + if (precision < 0) { + adjust_precision = false; + precision = 0; + } } else precision = 0; } else