From 1def2b93ca51d50073cce223ae2531ab049119dd Mon Sep 17 00:00:00 2001 From: Dmitry Volyntsev Date: Mon, 21 Sep 2026 20:53:54 -0700 Subject: [PATCH] Core: avoid float padding pointer wraparound Skip padding when the formatted float is wider than its requested field. This prevents unsigned width subtraction from forming an invalid pointer. --- src/njs_sprintf.c | 7 +++---- src/test/njs_unit_test.c | 19 +++++++++++++++++++ 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/src/njs_sprintf.c b/src/njs_sprintf.c index 64fae9c2..98b535a8 100644 --- a/src/njs_sprintf.c +++ b/src/njs_sprintf.c @@ -564,8 +564,9 @@ njs_float(njs_sprintf_t *spf, u_char *buf, double n) /* Zero or space padding. */ - if (spf->width != 0) { - length = (temp + NJS_DOUBLE_LEN) - p; + length = (temp + NJS_DOUBLE_LEN) - p; + + if (spf->width > length) { end = buf + (spf->width - length); end = njs_min(end, spf->end); @@ -576,8 +577,6 @@ njs_float(njs_sprintf_t *spf, u_char *buf, double n) /* Number copying. */ - length = (temp + NJS_DOUBLE_LEN) - p; - end = buf + length; end = njs_min(end, spf->end); diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c index 70c3af7b..f0258738 100644 --- a/src/test/njs_unit_test.c +++ b/src/test/njs_unit_test.c @@ -24100,6 +24100,25 @@ njs_chb_test(njs_vm_t *vm, njs_opts_t *opts, njs_stat_t *stat) goto done; } + njs_mp_free(njs_vm_memory_pool(vm), string.start); + + njs_chb_destroy(&chain); + NJS_CHB_MP_INIT(&chain, njs_vm_memory_pool(vm)); + + njs_chb_sprintf(&chain, 32, "%2f", 123.45); + + ret = njs_chb_join(&chain, &string); + if (ret != NJS_OK) { + njs_printf("njs_chb_join() failed\n"); + goto done; + } + + if (!njs_strstr_eq(&string, &(njs_str_t) njs_str("123.45"))) { + ret = NJS_ERROR; + njs_printf("njs_chb_sprintf() corrupts float \"%V\"\n", &string); + goto done; + } + njs_chb_destroy(&chain); njs_mp_free(njs_vm_memory_pool(vm), string.start); -- 2.47.3