fp_uscale.c: clamp precision in %g to avoid OOB in fixed_width

When sprintf is called with a precision larger than the double's
significand width (e.g. "%.51g"), fixed_width() indexed pow10 tables
out of bounds and produced a negative shift exponent. Cap the
internal digit count to 18 in the %g branch, matching the existing
%e and %f branches; downstream loops already zero-pad to the
caller's precision so visible output is unchanged.

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Yukihiro "Matz" Matsumoto
2026-05-12 11:18:57 +09:00
parent 16151a0daa
commit 478ada3bf4
2 changed files with 14 additions and 2 deletions
+4 -2
View File
@@ -1247,8 +1247,10 @@ mrb_format_float(mrb_float f, char *buf, size_t buf_size, char fmt, int prec, ch
}
else if (fmt == 'g') {
/* g/G format */
int fprec;
fixed_width((double)f, prec, &d, &p);
int fprec, n = prec;
if (n > 18) n = 18;
if (n < 1) n = 1;
fixed_width((double)f, n, &d, &p);
nd = count_digits(d);
exp = p + nd - 1;