sprintf.c: fix width underflow

* sprintf.c (rb_str_format): fix memory corruption by width
  underflow.  https://github.com/mruby/mruby/issues/3347

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@57108 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

sprintf.c

@@ -705,10 +705,10 @@ rb_str_format(int argc, const VALUE *argv, VALUE fmt)
 		    CHECK(n);
 		    rb_enc_mbcput(c, &buf[blen], enc);
 		    blen += n;
-		    FILL(' ', width-1);
+		    if (width > 1) FILL(' ', width-1);
 		}
 		else {
-		    FILL(' ', width-1);
+		    if (width > 1) FILL(' ', width-1);
 		    CHECK(n);
 		    rb_enc_mbcput(c, &buf[blen], enc);
 		    blen += n;

test/ruby/test_sprintf.rb

@@ -446,4 +446,9 @@ class TestSprintf < Test::Unit::TestCase
     h = { key: nil, key2: "key2_val" }
     assert_equal("key is , key2 is key2_val", "key is %{key}, key2 is %{key2}" % h)
   end
+
+  def test_width_underflow
+    bug = 'https://github.com/mruby/mruby/issues/3347'
+    assert_equal("!", sprintf("%*c", 0, ?!.ord), bug)
+  end
 end