fmt: don't overrun fmt string buffer

For input like "{", "{1", etc., we would exit the loop due to
`i < fmt.size()` no longer being the case, and then check if
`++i == fmt.size()`.  That would increment i to `fmt.size() + 1`,
and so execution continues.

The intention is to move i beyond the ':', so we do it only in that
case instead.
This commit is contained in:
Charlotte 2023-06-28 11:51:12 +10:00 committed by Marcelina Kościelnicka
parent 51d9b73107
commit 28bd3a4b5d
1 changed files with 2 additions and 1 deletions

View File

@ -55,12 +55,13 @@ void Fmt::parse_rtlil(RTLIL::Cell *cell) {
arg_size *= 10; arg_size *= 10;
arg_size += fmt[i] - '0'; arg_size += fmt[i] - '0';
} else if (fmt[i] == ':') { } else if (fmt[i] == ':') {
++i;
break; break;
} else { } else {
log_assert(false && "Unexpected character in format substitution"); log_assert(false && "Unexpected character in format substitution");
} }
} }
if (++i == fmt.size()) if (i == fmt.size())
log_assert(false && "Unexpected end in format substitution"); log_assert(false && "Unexpected end in format substitution");
if ((size_t)args.size() < arg_size) if ((size_t)args.size() < arg_size)