From b1d70b6144c7a61e580eb44ec7d1bdd2368f5531 Mon Sep 17 00:00:00 2001 From: Paul Dreik Date: Fri, 10 May 2019 08:52:57 +0200 Subject: [PATCH] prevent excessive time (found by oss-fuzz) the following triggered this: std::string message = fmt::format("\377{:.214718908}\377", fmt::arg("/\0", 0.f)); there are probably more places with calls to fill_n which could be checked --- include/fmt/format.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/include/fmt/format.h b/include/fmt/format.h index 49a6a29284f1..2e4e90a173bf 100644 --- a/include/fmt/format.h +++ b/include/fmt/format.h @@ -1187,6 +1187,12 @@ It grisu_prettify(const char* digits, int size, int exp, It it, int num_zeros = (std::max)(params.num_digits - full_exp, 1); if (params.trailing_zeros) { *it++ = static_cast('.'); +#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION + //avoid getting stuck here + if(num_zeros>100000) { + throw std::runtime_error("fuzz mode - avoiding excessive memory"); + } +#endif it = std::fill_n(it, num_zeros, static_cast('0')); } } else if (full_exp > 0) {