[Bug #18956] Negative codepoints are invalid characters

sprintf.c

@@ -447,8 +447,8 @@ rb_str_format(int argc, const VALUE *argv, VALUE fmt)
                     goto format_s1;
                 }
                 else {
-                    c = NUM2INT(val);
-                    n = rb_enc_codelen(c, enc);
+                    n = NUM2INT(val);
+                    if (n >= 0) n = rb_enc_codelen((c = n), enc);
                 }
                 if (n <= 0) {
                     rb_raise(rb_eArgError, "invalid character");

test/ruby/test_sprintf.rb

@@ -368,6 +368,7 @@ class TestSprintf < Test::Unit::TestCase
     assert_equal(" " * (BSIZ - 1) + "a", sprintf(" " * (BSIZ - 1) + "%-1c", ?a))
     assert_equal(" " * BSIZ + "a", sprintf("%#{ BSIZ + 1 }c", ?a))
     assert_equal("a" + " " * BSIZ, sprintf("%-#{ BSIZ + 1 }c", ?a))
+    assert_raise(ArgumentError) { sprintf("%c", -1) }
   end
 
   def test_string