boost::format %Nt tabulation: unchecked str2int -> unbounded std::string allocation

[rcanzanese]

We are filing this as hardening and not as a security advisory. This is one of two issues the Netskope Threat Labs team discovered and is reporting. They share no root cause with this report and can be triaged independently.

Technical details

Component	boost/format/parsing.hpp:70-83,178-180,233-234,314-318; format_implementation.hpp:228,233-238,257-263
Upstream tested	boostorg/format @ 3fb39d7 (develop HEAD)
Class	CWE-190 -> CWE-789 uncontrolled allocation (DoS, not OOB - std::string throws first)
Severity	LOW — CVSS ~3.7
Reachability	boost::format(attacker_format_string)

---

Root cause

str2int multiplies/adds digit-by-digit into signed Res, no overflow/magnitude check. %Nt tabulation -> width_ -> str() reserves/appends width_ chars.

Trigger

boost::str(boost::format("%2147483647t")); // 13-byte format string -> ~2GiB alloc attempt

Upstream status

Present in vendored 1.65; needs check vs boost develop HEAD

Suggested fix

Clamp str2int() result to a sane bound (e.g. 1<<20) so %Nt width and %N$ position cannot reach overflow/huge-alloc territory:

 template<class Res, class Iter>
 Res str2int (Iter& start, Iter last, ...) {
     Res n = 0;
-    for (; start != last && isdigit(*start); ++start)
-        n = n*10 + (*start - '0');
+    for (; start != last && isdigit(*start); ++start) {
+        if (n > (std::numeric_limits<Res>::max() - 9) / 10) { n = (1<<20); break; }
+        n = n*10 + (*start - '0');
+    }
     return n;
 }

---