Core: avoid float padding pointer wraparound

Skip padding when the formatted float is wider than its requested field.
This prevents unsigned width subtraction from forming an invalid pointer.

diff --git a/src/njs_sprintf.c b/src/njs_sprintf.c
index 64fae9c28db7c907a3052ba1452c1050efbb8640..98b535a837fd2762ddcccdffd3a2aa341968b5c2 100644 (file)
--- a/src/njs_sprintf.c
+++ b/src/njs_sprintf.c
@@ -564,8 +564,9 @@ njs_float(njs_sprintf_t *spf, u_char *buf, double n)
 
     /* Zero or space padding. */
 
-    if (spf->width != 0) {
-        length = (temp + NJS_DOUBLE_LEN) - p;
+    length = (temp + NJS_DOUBLE_LEN) - p;
+
+    if (spf->width > length) {
         end = buf + (spf->width - length);
         end = njs_min(end, spf->end);
 
@@ -576,8 +577,6 @@ njs_float(njs_sprintf_t *spf, u_char *buf, double n)
 
     /* Number copying. */
 
-    length = (temp + NJS_DOUBLE_LEN) - p;
-
     end = buf + length;
     end = njs_min(end, spf->end);
 

diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index 70c3af7b7f2f8031fc2689c65270cee1e4de43f8..f0258738bc56d92a599d485dbb4ac279988fc715 100644 (file)
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -24100,6 +24100,25 @@ njs_chb_test(njs_vm_t *vm, njs_opts_t *opts, njs_stat_t *stat)
         goto done;
     }
 
+    njs_mp_free(njs_vm_memory_pool(vm), string.start);
+
+    njs_chb_destroy(&chain);
+    NJS_CHB_MP_INIT(&chain, njs_vm_memory_pool(vm));
+
+    njs_chb_sprintf(&chain, 32, "%2f", 123.45);
+
+    ret = njs_chb_join(&chain, &string);
+    if (ret != NJS_OK) {
+        njs_printf("njs_chb_join() failed\n");
+        goto done;
+    }
+
+    if (!njs_strstr_eq(&string, &(njs_str_t) njs_str("123.45"))) {
+        ret = NJS_ERROR;
+        njs_printf("njs_chb_sprintf() corrupts float \"%V\"\n", &string);
+        goto done;
+    }
+
     njs_chb_destroy(&chain);
     njs_mp_free(njs_vm_memory_pool(vm), string.start);