`printf %'d` segfault/bus error on bad input

[adavies42]

this is on an M5 mac; on x86_64 linux, the crash is a segfault:

$ ksh
$ echo $KSH_VERSION                                                                                                                                                                                                                                                                                                                                                                                                                   
Version AJM 93u+m/1.0.10 2024-08-01
$ locale                     
LANG="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_CTYPE="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_ALL=
$ printf $'%\'d\n' 1,2m34    
ksh: printf: 1,2m34: arithmetic syntax error
Bus error: 10              ksh
$ 

[McDutchie]

Thanks for the report.

This crash occurs in locales where the radix point is ., not ,.

AddressSanitizer backtrace:

$ bin/package use
package: You are now entering a new environment set up to use the package in:
package:     /usr/local/src/ksh93/ksh/arch/darwin.arm64-64,a
package: You're using the shell:
package:     /usr/local/src/ksh93/ksh/arch/darwin.arm64-64,a/dyn/bin/ksh
package: Type 'exit' to leave and go back to normal.
Welcome to ksh 93u+m/1.1.0-alpha+4ef1273a 2026-07-06 on greybeard (ttys007)
- Have a look at ~ast/etc/kshrc to see all the cool stuff activated here
- Type 'builtin' for a list of built-in commands (with and without path)
- Autoloadable functions have been activated. Check them out in ~ast/fun
- Get help: use 'man commandname' for everything, even built-in commands
«0»13:…/src/ksh93/ksh[dev] $ export LANG=C          
<0>14:.../src/ksh93/ksh[dev] $ printf $'%\'d\n' 1,2m34
/usr/local/src/ksh93/ksh/arch/darwin.arm64-64,a/dyn/bin/ksh: printf: 1,2m34: arithmetic syntax error
=================================================================
==63038==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x00016f0d6b18 at pc 0x0001013b50d4 bp 0x00016f0d6af0 sp 0x00016f0d6ae8
WRITE of size 8 at 0x00016f0d6b18 thread T0
    #0 0x0001013b50d0 in arith_exec streval.c:479
    #1 0x0001013bceac in arith_strval streval.c:948
    #2 0x0001012977a0 in sh_strnum arith.c:609
    #3 0x000101251e7c in extend print.c:933
    #4 0x000101a3d794 in sfvprintf sfvprintf.c:542
    #5 0x000101a11ea8 in sfprintf sfprintf.c:32
    #6 0x00010124eb1c in b_print print.c:387
    #7 0x00010124f684 in b_printf print.c:149
    #8 0x0001013d7218 in sh_exec xec.c:1216
    #9 0x000101276cc0 in exfile main.c:569
    #10 0x000101273800 in sh_main main.c:321
    #11 0x000100d1c750 in main pmain.c:41
    #12 0x000193b52b94  (<unknown module>)

Address 0x00016f0d6b18 is located in stack of thread T0 at offset 24 in frame
    #0 0x0001013b227c in arith_exec streval.c:139

  This frame has 4 object(s):
    [32, 136) 'small_stack' (line 144) <== Memory access at offset 24 underflows this variable
    [176, 248) 'arg' (line 144)
    [288, 296) 'ptr' (line 145)
    [320, 392) 'node' (line 149)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-underflow streval.c:479 in arith_exec
Shadow bytes around the buggy address:
  0x00016f0d6880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x00016f0d6900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x00016f0d6980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x00016f0d6a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x00016f0d6a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x00016f0d6b00: f1 f1 f1[f1]00 00 00 00 00 00 00 00 00 00 00 00
  0x00016f0d6b80: 00 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 f2
  0x00016f0d6c00: f2 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00 00 00 00
  0x00016f0d6c80: 00 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
  0x00016f0d6d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x00016f0d6d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==63038==ABORTING
Abort