[Tcl-bugs] [ tcl-Bugs-2845535 ] crash issue with [format]

[SourceForge.net <no...@so...>]

Bugs item #2845535, was opened at 2009-08-27 13:38
Message generated for change (Settings changed) made by dkf
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=2845535&group_id=10894

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
>Category: 10. Objects
Group: development: 8.6b1.1
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Joe Mistachkin (mistachkin)
>Assigned to: Don Porter (dgp)
Summary: crash issue with [format]

Initial Comment:
The following command triggers a crash in 8.4, 8.5, and HEAD:

format "%.2147483647f" 2

The following command triggers a crash in 8.5 and HEAD (in 8.4 it produces some kind of result):

format "%2147483647.f" 2

The following code (near line 2187) in "generic\tclStringObj.c" is a bit problematic due to unchecked usage of sprintf with a fixed size buffer:

	    char spec[2*TCL_INTEGER_SPACE + 9], *p = spec;
	    <snip>
	    if (width) {
		p += sprintf(p, "%d", width);
		if (width > length) {
		    length = width;
		} 
	    }
	    if (gotPrecision) {
		*p++ = '.';
		p += sprintf(p, "%d", precision);
		length += precision;
	    }


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=2845535&group_id=10894