From dd4227f444be14de1f5044fcc5206e85a359190c Mon Sep 17 00:00:00 2001 From: "Sergio R. Caprile" Date: Tue, 20 Sep 2022 11:57:04 -0300 Subject: [PATCH] Fix issue #1733 --- mongoose.c | 4 +++- src/fmt.c | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/mongoose.c b/mongoose.c index f125bd52..df4f6aec 100644 --- a/mongoose.c +++ b/mongoose.c @@ -559,7 +559,9 @@ static size_t mg_dtoa(char *dst, size_t dstlen, double d, int width) { } while (n > 0 && buf[s + n - 1] == '0') n--; // Trim trailing zeros if (n > 0 && buf[s + n - 1] == '.') n--; // Trim trailing dot - buf[s + n] = '\0'; + n += s; + if (n >= (int) sizeof(buf)) n = (int) sizeof(buf) - 1; + buf[n] = '\0'; return mg_snprintf(dst, dstlen, "%s", buf); } diff --git a/src/fmt.c b/src/fmt.c index 6d724ca4..947d9736 100644 --- a/src/fmt.c +++ b/src/fmt.c @@ -148,7 +148,9 @@ static size_t mg_dtoa(char *dst, size_t dstlen, double d, int width) { } while (n > 0 && buf[s + n - 1] == '0') n--; // Trim trailing zeros if (n > 0 && buf[s + n - 1] == '.') n--; // Trim trailing dot - buf[s + n] = '\0'; + n += s; + if (n >= (int) sizeof(buf)) n = (int) sizeof(buf) - 1; + buf[n] = '\0'; return mg_snprintf(dst, dstlen, "%s", buf); }