Fix out-of-bounds read in error code format parsing (#4934)

This commit is contained in:
IfkumRfnl 2026-09-07 22:35:29 +04:00 committed by GitHub
parent 7071103cea
commit 8a7aea0422
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 12 additions and 1 deletions

View File

@ -549,9 +549,10 @@ template <> struct formatter<std::error_code> {
if (it == end) return it;
it = detail::parse_align(it, end, specs_);
if (it == end) return it;
char c = *it;
if (it != end && ((c >= '1' && c <= '9') || c == '{'))
if ((c >= '1' && c <= '9') || c == '{')
it = detail::parse_width(it, end, specs_, width_ref_, ctx);
if (it != end && *it == '?') {

View File

@ -349,6 +349,16 @@ TEST(std_test, error_code) {
"{\"generic:42\": 0}");
}
TEST(std_test, error_code_truncated_alignment) {
// No null terminator: reading past the format string must be detectable.
const char format[] = {'{', ':', '>'};
auto ec = std::error_code(42, std::generic_category());
EXPECT_THROW(
(void)fmt::vformat(fmt::string_view(format, sizeof(format)),
fmt::make_format_args(ec)),
fmt::format_error);
}
template <typename Catch> void exception_test() {
try {
throw std::runtime_error("Test Exception");