[php-src] PR #23416: Fix unbounded write on negative star precision in format_converter
| From: | iliaal | Date: | Sat, 22 Aug 2026 16:50:58 +0000 |
| Subject: | [php-src] PR #23416: Fix unbounded write on negative star precision in format_converter | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38080@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23416
Author: iliaal
A negative star precision was only clamped to -1, so FIX_PRECISION() treated it as SIZE_MAX and
wrote backwards through the buffer. Treat omitted precision that way in format_converter() only.
xbuf_format_converter() keeps -1 as the %H shortest-float sentinel used by serialize_precision.