From dee72daf97ccff577d62fe1cdf2e9b1c227fa245 Mon Sep 17 00:00:00 2001
From: "Yukihiro \"Matz\" Matsumoto" <matz@ruby.or.jp>
Date: Wed, 22 Oct 2025 15:25:47 +0900
Subject: [PATCH] mruby-sprintf: prevent buffer overread in named format
 parsing; fix #6648

add bounds check at retry label to prevent reading past end of format string
when parsing unterminated named parameters like %<foo without closing >

Co-authored-by: Claude <noreply@anthropic.com>
---
 mrbgems/mruby-sprintf/src/sprintf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/mrbgems/mruby-sprintf/src/sprintf.c b/mrbgems/mruby-sprintf/src/sprintf.c
index f2caada22..0ee9a60b3 100644
--- a/mrbgems/mruby-sprintf/src/sprintf.c
+++ b/mrbgems/mruby-sprintf/src/sprintf.c
@@ -413,6 +413,9 @@ mrb_str_format(mrb_state *mrb, mrb_int argc, const mrb_value *argv, mrb_value fm
     nextvalue = mrb_undef_value();
 
 retry:
+    if (p >= end) {
+      mrb_raise(mrb, E_ARGUMENT_ERROR, "malformed format string - unexpected end");
+    }
     {
       fmt_spec_t spec = get_format_info(*p);