crash in grisu2_prettify

[pauldreik]

Hi,
I found another crash through fuzzing sprintf. It gives a segmentation fault (using address sanitizer also works).

#include <fmt/printf.h>

int
main()
{
  int a = -13;
  float b = -1e19;
  std::string message = fmt::sprintf("%.*%", a, b);
}

I think the reason is that

it = copy_str<Char>(digits + full_exp, digits + size, it);

on format.h line 1203
gets an invalid range. I added assert(full_exp<=size); which is triggered by this.

By the way, I pushed my fuzzers to here in case you or someone else wants to fuzz.

Thanks,
Paul

[vitaut]

Thanks! This is a bug in fmt::sprintf - negative precision should have been converted to zero (the check in prettifier is actually redundant). I didn't even know printf allows negative precision =). Fixed in bd516e3.