From 8a7aea04222d6680aae2c69fe8d514ffc2f9808d Mon Sep 17 00:00:00 2001 From: IfkumRfnl <63595916+IfkumRfnl@users.noreply.github.com> Date: Mon, 7 Sep 2026 22:35:29 +0400 Subject: [PATCH] Fix out-of-bounds read in error code format parsing (#4934) --- include/fmt/std.h | 3 ++- test/std-test.cc | 10 ++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/include/fmt/std.h b/include/fmt/std.h index ed169de5..1c43e007 100644 --- a/include/fmt/std.h +++ b/include/fmt/std.h @@ -549,9 +549,10 @@ template <> struct formatter { if (it == end) return it; it = detail::parse_align(it, end, specs_); + if (it == end) return it; char c = *it; - if (it != end && ((c >= '1' && c <= '9') || c == '{')) + if ((c >= '1' && c <= '9') || c == '{') it = detail::parse_width(it, end, specs_, width_ref_, ctx); if (it != end && *it == '?') { diff --git a/test/std-test.cc b/test/std-test.cc index 9cb02dcd..eaf238b4 100644 --- a/test/std-test.cc +++ b/test/std-test.cc @@ -349,6 +349,16 @@ TEST(std_test, error_code) { "{\"generic:42\": 0}"); } +TEST(std_test, error_code_truncated_alignment) { + // No null terminator: reading past the format string must be detectable. + const char format[] = {'{', ':', '>'}; + auto ec = std::error_code(42, std::generic_category()); + EXPECT_THROW( + (void)fmt::vformat(fmt::string_view(format, sizeof(format)), + fmt::make_format_args(ec)), + fmt::format_error); +} + template void exception_test() { try { throw std::runtime_error("Test Exception");