Code: static int string_check(char *buf, const char *buf2)
 {
   if(strcmp(buf, buf2)) {
     /* they shouldn't differ */
    printf("sprintf failed:\nwe '%s'\nsystem: '%s'\n",
           buf, buf2);
     return 1;
   }
   return 0;
 }

Vulnerability Type: Overflow 
CWE ID: CWE-119
Summary: curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.
Commit Message: printf: fix floating point buffer overflow issues

... and add a bunch of floating point printf tests