aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMikael Pettersson <[email protected]>2018-02-05 21:41:07 +0100
committerJohn Högberg <[email protected]>2018-02-13 10:19:20 +0100
commitcac015e654dbb3ab538cb26486115c4c9b4fc210 (patch)
tree329589f31393a078131103bc2f0edf7b9cf689fb
parent9d660e81152fd7640e12551b09eebae1ebb87c98 (diff)
downloadotp-cac015e654dbb3ab538cb26486115c4c9b4fc210.tar.gz
otp-cac015e654dbb3ab538cb26486115c4c9b4fc210.tar.bz2
otp-cac015e654dbb3ab538cb26486115c4c9b4fc210.zip
Fix size of fmt_double()'s format_str[] buffer
fmt_double() may write up to 8 characters into its format_str[] buffer, which however only has room for 7 characters. This case could be triggered by a call to erts_printf_format() with any floating-point format that also includes #, and + or a space, which may be uncommon, but a nif or driver could issue it.
-rw-r--r--erts/lib_src/common/erl_printf_format.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/erts/lib_src/common/erl_printf_format.c b/erts/lib_src/common/erl_printf_format.c
index 3302083288..5a680d6f9d 100644
--- a/erts/lib_src/common/erl_printf_format.c
+++ b/erts/lib_src/common/erl_printf_format.c
@@ -326,7 +326,7 @@ static int fmt_double(fmtfn_t fn,void*arg,double val,
{
int res;
int fi = 0;
- char format_str[7];
+ char format_str[8];
char sbuf[32];
char *bufp = sbuf;
double dexp;