From 3fa771ddedac25560be57f4055f1767e6c810f58 Mon Sep 17 00:00:00 2001 From: nagachika Date: Tue, 12 Apr 2022 20:08:08 +0900 Subject: [PATCH] Fix dtoa buffer overrun --- missing/dtoa.c | 3 ++- test/ruby/test_float.rb | 18 ++++++++++++++++++ 2 files changed, 20 insertions(+), 1 deletions(-) diff --git a/missing/dtoa.c b/missing/dtoa.c index a940eabd9141..b7a83028758b 100644 --- a/missing/dtoa.c +++ b/missing/dtoa.c @@ -1552,6 +1552,7 @@ strtod(const char *s00, char **se) if (!*++s || !(s1 = strchr(hexdigit, *s))) goto ret0; if (*s == '0') { while (*++s == '0'); + if (!*s) goto ret; s1 = strchr(hexdigit, *s); } if (s1 != NULL) { @@ -1574,7 +1575,7 @@ strtod(const char *s00, char **se) for (; *s && (s1 = strchr(hexdigit, *s)); ++s) { adj += aadj * ((s1 - hexdigit) & 15); if ((aadj /= 16) == 0.0) { - while (strchr(hexdigit, *++s)); + while (*++s && strchr(hexdigit, *s)); break; } } diff --git a/test/ruby/test_float.rb b/test/ruby/test_float.rb index fbf0d87f8efd..b218b72db52c 100644 --- a/test/ruby/test_float.rb +++ b/test/ruby/test_float.rb @@ -171,6 +171,24 @@ def test_strtod assert_raise(ArgumentError, n += z + "A") {Float(n)} assert_raise(ArgumentError, n += z + ".0") {Float(n)} end + + x = nil + 2000.times do + x = Float("0x"+"0"*30) + break unless x == 0.0 + end + assert_equal(0.0, x, ->{"%a" % x}) + x = nil + 2000.times do + begin + x = Float("0x1."+"0"*270) + rescue ArgumentError => e + raise unless /"0x1\.0{270}"/ =~ e.message + else + break + end + end + assert_nil(x, ->{"%a" % x}) end def test_divmod -- 1.8.3.1