uutils/coreutils · error · io::Error

formatting width too large

Error message

formatting width too large

What it means

uucore's format feature caps any formatting width at MAX_FORMAT_WIDTH (1,000,000). check_width returns an io::Error with kind OutOfMemory and message 'formatting width too large' when a requested width exceeds that, protecting against enormous buffer allocation from absurd pad widths.

Solutions

1. Reduce the format width to <= 1,000,000 in the format string.
2. If a very large width is genuinely needed, implement padding manually (repeat fill characters) instead of width specifiers.
3. Clamp computed widths in scripts before interpolating them into format strings.
4. Sanitize user-supplied width values at the script/tool boundary.

Example fix

#!/bin/sh
width=2000000
# before: printf "%${width}d\n" 42 -> formatting width too large
[ "$width" -le 1000000 ] || width=1000000
# after: clamped width
printf "%${width}d\n" 42

// Clamp width before building a format spec
const MAX_WIDTH = 1_000_000;
const w = Number(widthInput);
if (!Number.isInteger(w) || w < 0 || w > MAX_WIDTH) {
  throw new RangeError(`width must be 0..${MAX_WIDTH}`);
}
const spec = `%${w}d`;

function isValidWidth(w) {
  return Number.isInteger(w) && w >= 0 && w <= 1_000_000;
}

match check_width(requested) {
  Err(e) if e.kind() == io::ErrorKind::OutOfMemory => {
    eprintln!("width too large (max 1000000); reduce or pad manually");
  }
  Err(e) => return Err(e),
  Ok(()) => format_with_width(requested),
}

When it happens

Trigger: Calling printf/seq-like formatting with a width larger than 1,000,000, e.g. `printf '%10000000d' 1`, or programmatic use of uucore::format with a parsed width spec beyond the cap; widths parsed from user-provided format strings.

Common situations: Scripts computing pad widths dynamically (e.g. width = big number from data) exceeding the cap; typos adding zeros to a width; porting from systems with different width limits where GNU allowed larger values.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

AI-assisted analysis of uutils/coreutils@92995feca2 (2026-09-20). Data as JSON: /api/errors/ffdb99f1350ef4a9. Report an issue: GitHub.

Appendix: source

Thrown at src/uucore/src/lib/features/format/mod.rs:183

                "digits" => String::from_utf8_lossy(digits)
            ),
            Self::InvalidEncoding(no) => return no.fmt(f),
        };
        f.write_str(&message)
    }
}

/// Maximum width for formatting to prevent memory allocation panics.
/// Rust's formatter will panic when trying to allocate memory for very large widths.
/// This limit is somewhat arbitrary but should be well above any practical use case
/// while still preventing formatter panics.
const MAX_FORMAT_WIDTH: usize = 1_000_000;

/// Check if a width is too large for formatting.
/// Returns an error if the width exceeds MAX_FORMAT_WIDTH.
fn check_width(width: usize) -> std::io::Result<()> {
    if width > MAX_FORMAT_WIDTH {
        Err(std::io::Error::new(
            std::io::ErrorKind::OutOfMemory,
            "formatting width too large",
        ))
    } else {
        Ok(())
    }
}

/// Reject a precision larger than printf/C allows (`i32::MAX`).
///
/// A precision near `usize::MAX` would otherwise overflow the precision/exponent
/// arithmetic in the float formatters, so we cap it the way C `printf` does.
pub(crate) fn check_precision(precision: usize) -> Result<(), FormatError> {
    if precision > i32::MAX as usize {
        Err(FormatError::InvalidPrecision(precision.to_string()))
    } else {
        Ok(())
    }

View on GitHub (pinned to 92995feca2)