Fix out-of-bounds read in vprintf with trailing '%' (#4742)

2026-04-10 21:23:57 +02:00
parent be98ea8add
commit 4ccf1d4faf
2 changed files with 10 additions and 2 deletions
--- a/include/fmt/printf.h
+++ b/include/fmt/printf.h
@@ -438,6 +438,8 @@ void vprintf(buffer<Char>& buf, basic_string_view<Char> format,
    }
    write(out, basic_string_view<Char>(start, to_unsigned(it - 1 - start)));

+    if (it == end) report_error("invalid format string");
+
    auto specs = format_specs();
    specs.set_align(align::right);