Changeset 48247 in webkit for trunk/JavaScriptCore/wtf

Timestamp:

Sep 10, 2009, 1:51:29 AM (16 years ago)

Author:

[email protected]

Message:

2009-09-10 Ben Laurie <​[email protected]>

Reviewed by Adam Barth.

<​https://bugs.webkit.org/show_bug.cgi?id=26836>

If dtoa was given a small buffer and the number was either infinite or
NaN, then the buffer would be overflowed.

• wtf/dtoa.cpp:

File:

• trunk/JavaScriptCore/wtf/dtoa.cpp (modified) (1 diff)

trunk/JavaScriptCore/wtf/dtoa.cpp

@@ -1905 +1905 @@
         *sign = 0;
 
-    if ((word0(&u) & Exp_mask) == Exp_mask)
-    {
+    if ((word0(&u) & Exp_mask) == Exp_mask) {
         /* Infinity or NaN */
         *decpt = 9999;
-        if (!word1(&u) && !(word0(&u) & 0xfffff))
-            strcpy(result, "Infinity");
-        else 
-            strcpy(result, "NaN");
+        if (!word1(&u) && !(word0(&u) & 0xfffff)) {
+            strncpy(result, "Infinity", ndigits);
+            result[ndigits] = '\0';
+        } else {
+            strncpy(result, "NaN", ndigits);
+            result[ndigits] = '\0';
+        }
         return;
     }