_vsnprintf reads past the format parameter value about printf

[eyalroz]

@aptly-io : This library is unmaintained and has a large number of unresolved bugs. The maintained for is mine. Could you please test with my fork to see whether you see the bug there as well?

[ledvinap]

Fixing this needs sanitizing width/precision parsing, adding code that is used only in malformed program.
Passing invalid format string is probably in 'undefined behavior' category, so it may be better to ignore it.
There are tons of other things you can do with malformed format string that can't be sanitized (%n etc.)

[ledvinap]

It's not '%.'. '%\0' will behave the same, putting '\0' into output stream and continuing format expansion.

Special-casing '\0' in format character switch is possible, but see above.

[aptly-io]

@ledvinap I agree with you all input needs to be sanitized by the caller of printf().
I dont agree with leaving security holes. If %. cannot be supported correctly, it is better to remove it from this code base.
@eyalroz I see it also in that fork. I will make an issue there as well.
Thanks all for looking into it.

[aptly-io]

@ledvinap I will try that case as well. Thanks! It also fails in the fork.

[eyalroz]

So, this is not a bug, as incomplete format specifier at string end cause undefined behavior. I am considering an opt-in "sanitization" via a CMake option - please have a look at eyalroz#140. But - this issue needs to be closed. @aptly-io : Please close this...