Author: petergibbs
Date: Fri Jul 25 04:39:57 2008
New Revision: 29735
Modified:
trunk/src/spf_render.c
Log:
Amend spf_render to handle negative field width specified using * flag.
Behaviour per 'man sprintf' is to treat as minus flag and positive width.
Fixes #57260 segfaults.
Modified: trunk/src/spf_render.c
==============================================================================
--- trunk/src/spf_render.c (original)
+++ trunk/src/spf_render.c Fri Jul 25 04:39:57 2008
@@ -310,6 +310,7 @@
INTVAL len = 0;
INTVAL old = 0;
INTVAL pat_len = (INTVAL)string_length(interp, pat);
+ HUGEINTVAL num;
/* start with a buffer; double the pattern length to avoid realloc #1 */
STRING *targ = string_make_empty(interp, enum_stringrep_one, pat_len << 1);
@@ -492,8 +493,14 @@
case '*':
info.flags |= FLAG_WIDTH;
- info.width = (UINTVAL)obj->getint(interp,
- SIZE_XVAL, obj);
+ num = obj->getint(interp, SIZE_XVAL, obj);
+ if (num < 0) {
+ info.flags |= FLAG_MINUS;
+ info.width = -num;
+ }
+ else {
+ info.width = num;
+ }
/* fall through */
case '.':
