Do not read over buffer if format is a single #, and do not loop forever

if UTF-8 is unfinished in a format. Reported by Giorgi Kobakhia im GitHub issue 4735.
2026-02-13 17:49:15 +00:00 · 2025-12-04 20:49:57 +00:00
parent 9d6c69ebde
commit bd16b22dac
2 changed files with 2 additions and 3 deletions
--- a/format.c
+++ b/format.c
@@ -5541,7 +5541,8 @@ format_expand1(struct format_expand_state *es, const char *fmt)
 			buf[off++] = *fmt++;
 			continue;
 		}
-		fmt++;
+		if (*fmt++ == '\0')
+			break;

 		ch = (u_char)*fmt++;
 		switch (ch) {