Edson Tadeu reports on the following post http://lists.boost.org/boost-users/2006/05/19723.php about this bug in Boost.Format: line 138 of boost/format/format_implementation.hpp if( bound_.size()==0 || !bound_[ items_[i].argN_ ] ) can try to invalidly evaluate bound_[...] on vector bound_ with a negative index, which happens when items_[i].argN_ is one of the special values enum arg_values { argN_no_posit = -1, // non-positional directive. will set argN later argN_tabulation = -2, // tabulation directive. (no argument read) argN_ignored = -3 // ignored directive. (no argument read) }; as defined in boost/format/internals.hpp. The attached patches to boost/format/format_implementation.hpp and libs/format/test/format_test3.cpp avoid the invalid negative indexing and add a testcase for the problem, respectively. Any objections to my commiting? If there's no comment I'll be doing it tomorrow. Thank you, Joaquín M López Muñoz Telefónica, Investigación y Desarrollo 138c138 < if( bound_.size()==0 || !bound_[ items_[i].argN_ ] ) ---
if( bound_.size()==0 || items_[i].argN_<0 || !bound_[ items_[i].argN_ ] )
95c95,102 < ---
// testcase for bug reported at // http://lists.boost.org/boost-users/2006/05/19723.php format f("%40t%1%"); int x = 0; f.bind_arg(1, x); f.clear();