Check for \0 after skipping # not before in format_expand1, from ossfuzz.

2026-04-16 03:56:28 +00:00 · 2026-04-02 08:37:14 +00:00
parent cbb49e8c84
commit 8b51abef08
2 changed files with 6 additions and 5 deletions
--- a/format.c
+++ b/format.c
@@ -5444,7 +5444,7 @@ format_expand1(struct format_expand_state *es, const char *fmt)
 			buf[off++] = *fmt++;
 			continue;
 		}
-		if (*fmt++ == '\0')
+		if (*++fmt == '\0')
 			break;

 		ch = (u_char)*fmt++;