Fix a buffer overrun that could occur when using the format() function to format a very small real value with the "," modifier.

FossilOrigin-Name: 910e770ad4d8e8e45bf069af963f2e975bfcfb882578dc5fe714cd2396258934
2023-05-05 19:36:13 +00:00
parent ed96436f23
commit 77eb3e305c
4 changed files with 19 additions and 10 deletions
@@ -649,7 +649,7 @@ void sqlite3_str_vappendf(
        {
          i64 szBufNeeded;           /* Size of a temporary buffer needed */
          szBufNeeded = MAX(e2,0)+(i64)precision+(i64)width+15;
-          if( cThousand ) szBufNeeded += (e2+2)/3;
+          if( cThousand && e2>0 ) szBufNeeded += (e2+2)/3;
          if( szBufNeeded > etBUFSIZE ){
            bufpt = zExtra = printfTempBuf(pAccum, szBufNeeded);
            if( bufpt==0 ) return;