Fix an overflow in format_to_n (#2029)

2 files changed, 6 insertions, 1 deletions

diff --git a/include/fmt/core.h b/include/fmt/core.h
index 5135f1f9..7a0e8b89 100644
--- a/include/fmt/core.h
+++ b/include/fmt/core.h
@@ -761,7 +761,7 @@ class fixed_buffer_traits {
   explicit fixed_buffer_traits(size_t limit) : limit_(limit) {}
   size_t count() const { return count_; }
   size_t limit(size_t size) {
-    size_t n = limit_ - count_;
+    size_t n = limit_ > count_ ? limit_ - count_ : 0;
     count_ += size;
     return size < n ? size : n;
   }
diff --git a/test/format-test.cc b/test/format-test.cc
index d3f21b47..c995ff69 100644
--- a/test/format-test.cc
+++ b/test/format-test.cc
@@ -1967,6 +1967,11 @@ TEST(FormatTest, FormatToN) {
   result = fmt::format_to_n(buffer, 4, "{}", "ABCDE");
   EXPECT_EQ(5u, result.size);
   EXPECT_EQ("ABCD", fmt::string_view(buffer, 4));
+
+  buffer[3] = 'x';
+  result = fmt::format_to_n(buffer, 3, "{}", std::string(1000, '*'));
+  EXPECT_EQ(1000u, result.size);
+  EXPECT_EQ("***x", fmt::string_view(buffer, 4));
 }
 
 TEST(FormatTest, WideFormatToN) {