Skip to content

Fix out-of-bounds read in error code format parsing - #4934

Merged
vitaut merged 2 commits into
fmtlib:mainfrom
IfkumRfnl:fix/error-code-parser-out-of-bounds
Sep 7, 2026
Merged

Fix out-of-bounds read in error code format parsing#4934
vitaut merged 2 commits into
fmtlib:mainfrom
IfkumRfnl:fix/error-code-parser-out-of-bounds

Conversation

@IfkumRfnl

Copy link
Copy Markdown
Contributor

Summary

The std::error_code formatter read past the end of a format string when the string ended after an alignment specifier, for example, "{:>".

Added a check after alignment parsing to prevent this read:

if (it == end) return it;

Removed the redundant check before width parsing. Added two regression tests. Both tests failed with AddressSanitizer before the fix. All 28 std-test tests pass with AddressSanitizer after the fix.

@IfkumRfnl
IfkumRfnl requested a review from vitaut as a code owner September 7, 2026 01:42

@vitaut vitaut left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the fix. Overall looks good but one regression test should be sufficient, let's remove the redundant error_code_truncated_fill_alignment test.

@IfkumRfnl

Copy link
Copy Markdown
Contributor Author

Thanks for looking into it, removed the test.

@IfkumRfnl
IfkumRfnl requested a review from vitaut September 7, 2026 16:54
@vitaut
vitaut merged commit 8a7aea0 into fmtlib:main Sep 7, 2026
47 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants