shithub: libmujs

Download patch

ref: 833b6f1672b4f2991a63c4d05318f0b84ef4d550
parent: 292415b62547c0bec95ee63d836cb536c1ee9c84
author: Tor Andersson <tor.andersson@artifex.com>
date: Wed Apr 21 08:25:48 EDT 2021

Issue #148: Check for overflow when reading floating point exponent.

GCC with -O2 optimizes away the if(exp<-maxExponent) branch completely,
so we don't end up with the expected '512' value for overflowing
exponents. Limit the exponent parsing to MAX_INT instead to prevent
signed overflow from tripping up over-eager optimizing compilers.

--- a/jsdtoa.c

+++ b/jsdtoa.c

@@ -691,10 +691,12 @@

 			}

 			expSign = FALSE;

 		}

-		while ((*p >= '0') && (*p <= '9')) {

+		while ((*p >= '0') && (*p <= '9') && exp < INT_MAX/10) {

 			exp = exp * 10 + (*p - '0');

 			p += 1;

 		}

+		while ((*p >= '0') && (*p <= '9'))

+			p += 1;

 	}

 	if (expSign) {

 		exp = fracExp - exp;