mirror of git://git.musl-libc.org/musl
fix printf %ls with precision limit over-read issue
printf was not printing too many characters, but it was reading one too many wchar_t elements from the input. this could lead to crashes if running off the page, or spurious failure if the conversion of the extra wchar_t resulted in EILSEQ.
This commit is contained in:
parent
1429ce9ba2
commit
6e9ff6a4cf
|
@ -599,12 +599,12 @@ static int printf_core(FILE *f, const char *fmt, va_list *ap, union arg *nl_arg,
|
||||||
p = -1;
|
p = -1;
|
||||||
case 'S':
|
case 'S':
|
||||||
ws = arg.p;
|
ws = arg.p;
|
||||||
for (i=0; *ws && (l=wctomb(mb, *ws++))>=0 && l<=0U+p-i; i+=l);
|
for (i=l=0; i<p && *ws && (l=wctomb(mb, *ws++))>=0 && l<=0U+p-i; i+=l);
|
||||||
if (l<0) return -1;
|
if (l<0) return -1;
|
||||||
p = i;
|
p = i;
|
||||||
pad(f, ' ', w, p, fl);
|
pad(f, ' ', w, p, fl);
|
||||||
ws = arg.p;
|
ws = arg.p;
|
||||||
for (i=0; *ws && i+(l=wctomb(mb, *ws++))<=p; i+=l)
|
for (i=0; i<p && *ws && i+(l=wctomb(mb, *ws++))<=p; i+=l)
|
||||||
out(f, mb, l);
|
out(f, mb, l);
|
||||||
pad(f, ' ', w, p, fl^LEFT_ADJ);
|
pad(f, ' ', w, p, fl^LEFT_ADJ);
|
||||||
l = w>p ? w : p;
|
l = w>p ? w : p;
|
||||||
|
|
Loading…
Reference in New Issue