commit 3ab3c16db6a5674f53cf23d56512a405fde0b2c9
Author: Daniel Stenberg <[email protected]>
Date:   Tue Nov 8 15:32:37 2016 +0100

    printf: fix floating point buffer overflow issues
    
    ... and add a bunch of floating point printf tests

This patch is modified to adapt to curl 7.45.0 in Solaris.
--- lib/mprintf.c
+++ lib/mprintf.c
@@ -90,11 +90,12 @@
 #else
 #  define mp_intmax_t long
 #  define mp_uintmax_t unsigned long
 #endif
 
-#define BUFFSIZE 256 /* buffer for long-to-str and float-to-str calcs */
+#define BUFFSIZE 326 /* buffer for long-to-str and float-to-str calcs, should
+                        fit negative DBL_MAX (317 letters) */
 #define MAX_PARAMETERS 128 /* lame static limit */
 
 #ifdef __AMIGA__
 # undef FORMAT_INT
 #endif
@@ -914,16 +915,29 @@ static int dprintf_formatf(
           *fptr++ = '#';
 
         *fptr = 0;
 
         if(width >= 0) {
+          if(width >= (long)sizeof(work))
+            width = sizeof(work)-1;
           /* RECURSIVE USAGE */
           len = curl_msnprintf(fptr, left, "%ld", width);
           fptr += len;
           left -= len;
         }
         if(prec >= 0) {
+          /* for each digit in the integer part, we can have one less
+             precision */
+          size_t maxprec = sizeof(work) - 2;
+          double val = p->data.dnum;
+          while(val >= 10.0) {
+            val /= 10;
+            maxprec--;
+          }
+
+          if(prec > (long)maxprec)
+            prec = maxprec-1;
           /* RECURSIVE USAGE */
           len = curl_msnprintf(fptr, left, ".%ld", prec);
           fptr += len;
         }
         if(p->flags & FLAGS_LONG)
@@ -939,11 +953,13 @@ static int dprintf_formatf(
         *fptr = 0; /* and a final zero termination */
 
         /* NOTE NOTE NOTE!! Not all sprintf implementations return number of
            output characters */
         (sprintf)(work, formatbuf, p->data.dnum);
-
+#ifdef CURLDEBUG
+        assert(strlen(work) <= sizeof(work));
+#endif
         for(fptr=work; *fptr; fptr++)
           OUTCHAR(*fptr);
       }
       break;