From 0ed27d9700d6c2c0513198f0599b90916d3171fb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Wed, 20 May 2026 18:40:20 +0800
Subject: [PATCH] Format: fixes a possible OOB read

---
 src/common/impl/format.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/common/impl/format.c b/src/common/impl/format.c
index 1c11ac757..8ccd8ebf6 100644
--- a/src/common/impl/format.c
+++ b/src/common/impl/format.c
@@ -543,6 +543,12 @@ void ffParseFormatString(FFstrbuf* buffer, const FFstrbuf* formatstr, uint32_t n
         // jump to next char, the start of the placeholder value
         ++i;
 
+        // unmatched trailing '{'
+        if (i >= formatstr->length) {
+            ffStrbufAppendC(buffer, '{');
+            break;
+        }
+
         // double {{ elvaluates to a single { and doesn't count as start
         if (formatstr->chars[i] == '{') {
             ffStrbufAppendC(buffer, '{');