fmt_fp.c: truncate precision to prevent buffer overflow.

1 files changed, 4 insertions, 4 deletions

diff --git a/src/fmt_fp.c b/src/fmt_fp.c
index 807debe11..8a156b3d9 100644
--- a/src/fmt_fp.c
+++ b/src/fmt_fp.c
@@ -180,13 +180,13 @@ mrb_format_float(mrb_float f, char *buf, size_t buf_size, char fmt, int prec, ch
       dec = -1;
       *s++ = first_dig;
 
-      if (prec + e + 1 > buf_remaining) {
-        prec = buf_remaining - e - 1;
-      }
-
       if (org_fmt == 'g') {
         prec += (e - 1);
       }
+      // truncate precision to prevent buffer overflow
+      if (prec + 2 > buf_remaining) {
+        prec = buf_remaining - 2;
+      }
       num_digits = prec;
       if (num_digits || alt_form) {
         *s++ = '.';