From 305641222353ff241e1aa3dbdd289a583d522250 Mon Sep 17 00:00:00 2001
From: Aizal Khan <aizumusheer2@gmail.com>
Date: Tue, 27 Oct 2026 13:43:57 +0530
Subject: [PATCH] fix null pointer arithmetic for %s with precision in vprintf

---
 include/fmt/printf.h | 12 +++++++-----
 test/printf-test.cc  |  3 +++
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/include/fmt/printf.h b/include/fmt/printf.h
index a7213d01..19e5bbbc 100644
--- a/include/fmt/printf.h
+++ b/include/fmt/printf.h
@@ -494,11 +494,13 @@ void vprintf(buffer<Char>& buf, basic_string_view<Char> format,
     }
     if (specs.precision >= 0 && arg.type() == type::cstring_type) {
       auto str = arg.visit(get_cstring<Char>());
-      auto str_end = str + specs.precision;
-      auto nul = std::find(str, str_end, Char());
-      auto sv = basic_string_view<Char>(
-          str, to_unsigned(nul != str_end ? nul - str : specs.precision));
-      arg = sv;
+      if (str) {
+        auto str_end = str + specs.precision;
+        auto nul = std::find(str, str_end, Char());
+        auto sv = basic_string_view<Char>(
+            str, to_unsigned(nul != str_end ? nul - str : specs.precision));
+        arg = sv;
+      }
     }
     if (specs.fill_unit<Char>() == '0') {
       if (is_arithmetic_type(arg.type()) && specs.align() != align::left) {
diff --git a/test/printf-test.cc b/test/printf-test.cc
index db877d09..dbd46065 100644
--- a/test/printf-test.cc
+++ b/test/printf-test.cc
@@ -544,6 +544,9 @@ TEST(printf_test, string) {
   const char* null_str = nullptr;
   EXPECT_PRINTF("(null)", "%s", null_str);
   EXPECT_PRINTF("    (null)", "%10s", null_str);
+  // A precision must not apply pointer arithmetic to a null string argument.
+  EXPECT_PRINTF("(null)", "%.3s", null_str);
+  EXPECT_PRINTF("(null)", "%.0s", null_str);
 }
 
 TEST(printf_test, pointer) {