uutils/coreutils · warning · io::Error

formatting width too large

Error message

formatting width too large

What it means

`check_width` in the format feature rejects any requested formatting width above `MAX_FORMAT_WIDTH` (1,000,000). Allocating padding for an enormous width could exhaust memory, so it returns `io::ErrorKind::OutOfMemory` with "formatting width too large" instead.

Source

Thrown at src/uucore/src/lib/features/format/mod.rs:182

                "digits" => String::from_utf8_lossy(digits)
            ),
            Self::InvalidEncoding(no) => return no.fmt(f),
        };
        f.write_str(&message)
    }
}

/// Maximum width for formatting to prevent memory allocation panics.
/// Rust's formatter will panic when trying to allocate memory for very large widths.
/// This limit is somewhat arbitrary but should be well above any practical use case
/// while still preventing formatter panics.
const MAX_FORMAT_WIDTH: usize = 1_000_000;

/// Check if a width is too large for formatting.
/// Returns an error if the width exceeds MAX_FORMAT_WIDTH.
fn check_width(width: usize) -> std::io::Result<()> {
    if width > MAX_FORMAT_WIDTH {
        Err(std::io::Error::new(
            std::io::ErrorKind::OutOfMemory,
            "formatting width too large",
        ))
    } else {
        Ok(())
    }
}

/// Reject a precision larger than printf/C allows (`i32::MAX`).
///
/// A precision near `usize::MAX` would otherwise overflow the precision/exponent
/// arithmetic in the float formatters, so we cap it the way C `printf` does.
pub(crate) fn check_precision(precision: usize) -> Result<(), FormatError> {
    if precision > i32::MAX as usize {
        Err(FormatError::InvalidPrecision(precision.to_string()))
    } else {
        Ok(())
    }

View on GitHub (pinned to 85295bbf78)

Solutions

1. Reduce the requested width below 1,000,000
2. Sanitize/clamp widths parsed from user input before formatting
3. If a large width is genuinely needed, build the padding manually in chunks

Example fix

// before
let width: usize = s.parse()?;
format_args_width(value, width)?;
// after
let width: usize = s.parse()?.min(1_000_000);
format_args_width(value, width)?;

const MAX_FORMAT_WIDTH: usize = 1_000_000;
if width > MAX_FORMAT_WIDTH {
    return Err("formatting width too large");
}

fn width_in_range(w: usize) -> Option<usize> {
    (w <= 1_000_000).then_some(w)
}

match format_with_width(v, w) {
    Err(e) if e.kind() == std::io::ErrorKind::OutOfMemory => format_without_width(v),
    other => other?,
}

When it happens

Trigger: Calling formatting APIs (e.g. printf-style helpers) with a computed width that exceeds 1,000,000 — often from parsing an oversized width field in a user-supplied format string (`%1000000000d`-like inputs).

Common situations: printf/seq-like utilities fed a format string with a gigantic width, or width computed from user data without clamping.

AI-assisted analysis of uutils/coreutils@85295bbf78 (2026-08-31). Data as JSON: /api/errors/ffdb99f1350ef4a9. Report an issue: GitHub.