diff options
| author | Mikael Pettersson <[email protected]> | 2018-02-05 21:41:07 +0100 |
|---|---|---|
| committer | John Högberg <[email protected]> | 2018-02-13 10:19:20 +0100 |
| commit | cac015e654dbb3ab538cb26486115c4c9b4fc210 (patch) | |
| tree | 329589f31393a078131103bc2f0edf7b9cf689fb /erts/lib_src | |
| parent | 9d660e81152fd7640e12551b09eebae1ebb87c98 (diff) | |
| download | otp-cac015e654dbb3ab538cb26486115c4c9b4fc210.tar.gz otp-cac015e654dbb3ab538cb26486115c4c9b4fc210.tar.bz2 otp-cac015e654dbb3ab538cb26486115c4c9b4fc210.zip | |
Fix size of fmt_double()'s format_str[] buffer
fmt_double() may write up to 8 characters into its format_str[]
buffer, which however only has room for 7 characters.
This case could be triggered by a call to erts_printf_format() with
any floating-point format that also includes #, and + or a space,
which may be uncommon, but a nif or driver could issue it.
Diffstat (limited to 'erts/lib_src')
| -rw-r--r-- | erts/lib_src/common/erl_printf_format.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/erts/lib_src/common/erl_printf_format.c b/erts/lib_src/common/erl_printf_format.c index 3302083288..5a680d6f9d 100644 --- a/erts/lib_src/common/erl_printf_format.c +++ b/erts/lib_src/common/erl_printf_format.c @@ -326,7 +326,7 @@ static int fmt_double(fmtfn_t fn,void*arg,double val, { int res; int fi = 0; - char format_str[7]; + char format_str[8]; char sbuf[32]; char *bufp = sbuf; double dexp; |