# std.fmt: fix out-of-bounds array write in float printing · gitcafe/zig

[View on GitCafe](https://git.cafe/gitcafe/zig/commit/5762b6d2183581990c168099f277b77be55addd4)

Repository: [gitcafe/zig](https://git.cafe/gitcafe/zig)

Visibility: public

Requested revision: 5762b6d2183581990c168099f277b77be55addd4

Requested commit: 5762b6d2183581990c168099f277b77be55addd4

Commit: 5762b6d2183581990c168099f277b77be55addd4

Tree: 279a5296ae264f9fd21a0f6993b6af822172491f

Author: John Schmidt

Committer: Andrew Kelley

## Message

```
std.fmt: fix out-of-bounds array write in float printing

This commit fixes an out of bounds write that can occur when
formatting certain float values. The write messes up the stack and
causes incorrect results, segfaults, or nothing at all, depending on the
optimization mode used.

The `errol` function writes the digits of the float into `buffer`
starting from index 1, leaving index 0 untouched, and returns `buffer[1..]`
and the exponent. This is because `roundToPrecision` relies on index 0 being
unused in case the rounding adds a digit (e.g rounding 999.99
to 1000.00). When this happens, pointer arithmetic is used
[here](https://github.com/ziglang/zig/blob/0e6d2184cacf2dd1fad7508b2f9ae99d78763148/lib/std/fmt/errol.zig#L61-L65)
to access index 0 and put the ones digit in the right place.

However, `errol3u` contains two special cases: `errolInt` and `errolFixed`,
which return from the function early. For these two special cases
index 0 was never reserved, and the return value contains `buffer`
instead of `buffer[1..]`. This causes the pointer arithmetic in
`roundToPrecision` to write out of bounds, which in the case of
`std.fmt.formatFloatDecimal` messes up the stack and causes undefined behavior.

The fix is to move the slicing of `buffer` to `buffer[1..]` from `errol3u`
to `errol` so that both the default and the special cases operate on the sliced
buffer.
```

## Parents

- [8b5e4af78e1a4a75cf6d9225246bf3e8a195282d](https://git.cafe/gitcafe/zig/commit/8b5e4af78e1a4a75cf6d9225246bf3e8a195282d?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zig/tree/5762b6d2183581990c168099f277b77be55addd4?format=markdown)