[libc++][format] Fixes an off by one error.

[Mordante]

Summary

The post-condition on the functions is that the buffer is not full.
This post-conditon is used as pre-condition of the push_back function.
When a copy, fill, of transform function exactly fit in the buffer this
post-condition was validated.

[ldionne]

Did you find that with fuzzing?

[dim]

In D155397#4506191, @ldionne wrote:

Did you find that with fuzzing?

This was reported in the security bug tracker at https://bugs.chromium.org/p/llvm/issues/detail?id=48 . That issue was not accessible at first, but I have removed the security restriction now.

[avogelsgesang]

In D155397#4506191, @ldionne wrote:

Did you find that with fuzzing?

We (a small team inside Salesforce) found this in one of our production builds by accident / sheer luck. We are using -fexperimental-library already, because we recompile the world anyway (and don't need ABI stability) and are happy to rewrite our code in case breaking API changes are applied to libc++ or the C++ standard.

I agree that fuzzing might be a good idea for std::format to find this type of issues in a more structured way

[ldionne]

In D155397#4510120, @avogelsgesang wrote:

In D155397#4506191, @ldionne wrote:

Did you find that with fuzzing?

We (a small team inside Salesforce) found this in one of our production builds by accident / sheer luck. We are using -fexperimental-library already, because we recompile the world anyway (and don't need ABI stability) and are happy to rewrite our code in case breaking API changes are applied to libc++ or the C++ standard.

I agree that fuzzing might be a good idea for std::format to find this type of issues in a more structured way

Thanks for the context!

[Mordante]

In D155397#4506805, @dim wrote:

In D155397#4506191, @ldionne wrote:

Did you find that with fuzzing?

This was reported in the security bug tracker at https://bugs.chromium.org/p/llvm/issues/detail?id=48 . That issue was not accessible at first, but I have removed the security restriction now.

I indeed mention this privately to @ldionne since at that time the issue was still restricted.

In D155397#4510120, @avogelsgesang wrote:

In D155397#4506191, @ldionne wrote:

Did you find that with fuzzing?

We (a small team inside Salesforce) found this in one of our production builds by accident / sheer luck. We are using -fexperimental-library already, because we recompile the world anyway (and don't need ABI stability) and are happy to rewrite our code in case breaking API changes are applied to libc++ or the C++ standard.

I agree that fuzzing might be a good idea for std::format to find this type of issues in a more structured way

+1 This is already high on my priority list. D154140 enables fuzzing in our CI so when that lands I will look into fuzzing.

libcxx/include/__format/buffer.h

_LIBCPP_HIDE_FROM_ABI void __copy(basic_string_view<_InCharT> __str) {
     // The same holds true for the fill.
     // For transform it might be slightly harder, however the use case for
     // transform is slightly less common; it converts hexadecimal values to
     // upper case. For integral these strings are short.
     // TODO FMT Look at the improvements above.
     size_t __n = __str.size();
 
     __flush_on_overflow(__n);
-    if (__n <= __capacity_) {
+    if (__n < __capacity_) { //  push_back requires the buffer to have room for at least one character (so use <).
       _VSTD::copy_n(__str.data(), __n, _VSTD::addressof(__ptr_[__size_]));
       __size_ += __n;
       return;
     }
 
     // The output doesn't fit in the internal buffer.
     // Copy the data in "__capacity_" sized chunks.
     _LIBCPP_ASSERT_UNCATEGORIZED(__size_ == 0, "the buffer should be flushed by __flush_on_overflow");
public:
   ///
   /// Like @ref __copy it may need to do type conversion.
   template <__fmt_char_type _InCharT, class _UnaryOperation>
   _LIBCPP_HIDE_FROM_ABI void __transform(const _InCharT* __first, const _InCharT* __last, _UnaryOperation __operation) {
     _LIBCPP_ASSERT_UNCATEGORIZED(__first <= __last, "not a valid range");
 
     size_t __n = static_cast<size_t>(__last - __first);
     __flush_on_overflow(__n);
-    if (__n <= __capacity_) {
+    if (__n < __capacity_) { //  push_back requires the buffer to have room for at least one character (so use <).
       _VSTD::transform(__first, __last, _VSTD::addressof(__ptr_[__size_]), _VSTD::move(__operation));
       __size_ += __n;
       return;
     }
 
     // The output doesn't fit in the internal buffer.
     // Transform the data in "__capacity_" sized chunks.
     _LIBCPP_ASSERT_UNCATEGORIZED(__size_ == 0, "the buffer should be flushed by __flush_on_overflow");
     do {
       size_t __chunk = _VSTD::min(__n, __capacity_);
       _VSTD::transform(__first, __first + __chunk, _VSTD::addressof(__ptr_[__size_]), __operation);
       __size_ = __chunk;
       __first += __chunk;
       __n -= __chunk;
       __flush();
     } while (__n);
   }
 
   /// A \c fill_n wrapper.
   _LIBCPP_HIDE_FROM_ABI void __fill(size_t __n, _CharT __value) {
     __flush_on_overflow(__n);
-    if (__n <= __capacity_) {
+    if (__n < __capacity_) { //  push_back requires the buffer to have room for at least one character (so use <).
       _VSTD::fill_n(_VSTD::addressof(__ptr_[__size_]), __n, __value);
       __size_ += __n;
       return;
     }
 
     // The output doesn't fit in the internal buffer.
     // Fill the buffer in "__capacity_" sized chunks.
     _LIBCPP_ASSERT_UNCATEGORIZED(__size_ == 0, "the buffer should be flushed by __flush_on_overflow");

libcxx/test/std/utilities/format/format.functions/format_tests.h

default:
       assert(false && "Add the type to the list of cases.");
     }
   }
 #undef CASE
 
   return result;
 }
 
+template <class CharT, class TestFunction>
+void format_test_buffer_copy(TestFunction check) {
+  // *** copy ***
+  check(SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"),
+        SV("{}"),
+        SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"));
+
+  check(SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"),
+        SV("{}"),
+        SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"));
+
+  check(SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"),
+        SV("{}"),
+        SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"));
+
+  check(SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"),
+        SV("{}"),
+        SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"));
+
+  check(
+      SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"),
+      SV("{}"),
+      SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"));
+
+  // *** copy + push_back ***
+
+  check(SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "X"),
+        SV("{}X"),
+        SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"));
+
+  check(SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "X"),
+        SV("{}X"),
+        SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"));
+
+  check(SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "X"),
+        SV("{}X"),
+        SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"));
+
+  check(SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "X"),
+        SV("{}X"),
+        SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"));
+
+  check(
+      SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "X"),
+      SV("{}X"),
+      SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"));
+
+  // ***  push_back + copy ***
+
+  check(SV("X"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"),
+        SV("X{}"),
+        SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"));
+
+  check(SV("X"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"),
+        SV("X{}"),
+        SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"));
+
+  check(SV("X"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"),
+        SV("X{}"),
+        SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"));
+
+  check(SV("X"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"),
+        SV("X{}"),
+        SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+           "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"));
+
+  check(
+      SV("X"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"),
+      SV("X{}"),
+      SV("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+         "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"));
+}
+
+template <class CharT, class TestFunction>
+void format_test_buffer_full(TestFunction check) {
+  // *** fill ***
+  check(SV("||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"), SV("{:|<64}"), SV(""));
+
+  check(SV("||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"),
+        SV("{:|<128}"),
+        SV(""));
+
+  check(SV("||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"),
+        SV("{:|<256}"),
+        SV(""));
+
+  check(SV("||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"),
+        SV("{:|<512}"),
+        SV(""));
+
+  check(SV("||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"),
+        SV("{:|<1024}"),
+        SV(""));
+
+  // *** fill + push_back ***
+
+  check(SV("||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "X"),
+        SV("{:|<64}X"),
+        SV(""));
+
+  check(SV("||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "X"),
+        SV("{:|<128}X"),
+        SV(""));
+
+  check(SV("||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "X"),
+        SV("{:|<256}X"),
+        SV(""));
+
+  check(SV("||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "X"),
+        SV("{:|<512}X"),
+        SV(""));
+
+  check(SV("||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "X"),
+        SV("{:|<1024}X"),
+        SV(""));
+
+  // *** push_back + fill ***
+
+  check(SV("X"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"),
+        SV("X{:|<64}"),
+        SV(""));
+
+  check(SV("X"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"),
+        SV("X{:|<128}"),
+        SV(""));
+
+  check(SV("X"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"),
+        SV("X{:|<256}"),
+        SV(""));
+
+  check(SV("X"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"),
+        SV("X{:|<512}"),
+        SV(""));
+
+  check(SV("X"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"
+           "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||"),
+        SV("X{:|<1024}"),
+        SV(""));
+}
+
 // Using a const ref for world and universe so a string literal will be a character array.
 // When passed as character array W and U have different types.
 template <class CharT, class W, class U, class TestFunction, class ExceptionTest>
 void format_test_string(const W& world, const U& universe, TestFunction check, ExceptionTest check_exception) {
 
   // *** Valid input tests ***
   // Unused argument is ignored. TODO FMT what does the Standard mandate?
   check(SV("hello world"), SV("hello {}"), world, universe);
check(
       4,
       5,
       6,
       7,
       8,
       9,
       0);
 
+  // *** Test buffer boundaries format strings ***
+  if constexpr (modus == execution_modus::full) {
+    format_test_buffer_copy<CharT>(check);
+    format_test_buffer_full<CharT>(check);
+  }
+
   // *** Test invalid format strings ***
   check_exception("The format string terminates at a '{'", SV("{"));
   check_exception("The replacement field misses a terminating '}'", SV("{:"), 42);
 
   check_exception("The format string contains an invalid escape sequence", SV("}"));
   check_exception("The format string contains an invalid escape sequence", SV("{:}-}"), 42);
 
   check_exception("The format string contains an invalid escape sequence", SV("} "));