fmt: prevent panic from %.[]

Fixes #10675

Change-Id: Ia057427ce3e81d35f1ba6c354868a0ad6cc9abf2
Reviewed-on: https://go-review.googlesource.com/9636
Reviewed-by: Rob Pike <r@golang.org>

diff --git a/src/fmt/fmt_test.go b/src/fmt/fmt_test.go
index 90112bb2a3d93ee0631868695a80cf6f42ca7474..ab3ffaea6ee7d86fd39bf197d8930e3b7304eb3b 100644 (file)
--- a/src/fmt/fmt_test.go
+++ b/src/fmt/fmt_test.go
@@ -822,6 +822,7 @@ var reorderTests = []struct {
        {"%d %d %d %#[1]o %#o %#o %#o", SE{11, 12, 13}, "11 12 13 013 014 015 %!o(MISSING)"},
        {"%[5]d %[2]d %d", SE{1, 2, 3}, "%!d(BADINDEX) 2 3"},
        {"%d %[3]d %d", SE{1, 2}, "1 %!d(BADINDEX) 2"}, // Erroneous index does not affect sequence.
+       {"%.[]", SE{}, "%!](BADINDEX)"},                // Issue 10675
 }
 
 func TestReorder(t *testing.T) {

diff --git a/src/fmt/print.go b/src/fmt/print.go
index 1d8db0aac41dcb5a29f67475b897508671c7193f..d07835da4955cbe4409043deee0a6c99e38b27fb 100644 (file)
--- a/src/fmt/print.go
+++ b/src/fmt/print.go
@@ -1036,6 +1036,11 @@ func intFromArg(a []interface{}, argNum int) (num int, isInt bool, newArgNum int
 // up to the closing paren, if present, and whether the number parsed
 // ok. The bytes to consume will be 1 if no closing paren is present.
 func parseArgNumber(format string) (index int, wid int, ok bool) {
+       // There must be at least 3 bytes: [n].
+       if len(format) < 3 {
+               return 0, 1, false
+       }
+
        // Find closing bracket.
        for i := 1; i < len(format); i++ {
                if format[i] == ']' {
@@ -1062,7 +1067,7 @@ func (p *pp) argNumber(argNum int, format string, i int, numArgs int) (newArgNum
                return index, i + wid, true
        }
        p.goodArgNum = false
-       return argNum, i + wid, true
+       return argNum, i + wid, ok
 }
 
 func (p *pp) doPrintf(format string, a []interface{}) {
@@ -1132,7 +1137,7 @@ func (p *pp) doPrintf(format string, a []interface{}) {
                                p.goodArgNum = false
                        }
                        argNum, i, afterIndex = p.argNumber(argNum, format, i, len(a))
-                       if format[i] == '*' {
+                       if i < end && format[i] == '*' {
                                i++
                                p.fmt.prec, p.fmt.precPresent, argNum = intFromArg(a, argNum)
                                if !p.fmt.precPresent {