Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(178)

Side by Side Diff: base/third_party/dmg_fp/dtoa.cc

Issue 2451573005: Fix integer-overflow in dmg_fp::strtod (Closed)
Patch Set: Created 4 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | base/third_party/dmg_fp/exp_length.patch » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 /**************************************************************** 1 /****************************************************************
2 * 2 *
3 * The author of this software is David M. Gay. 3 * The author of this software is David M. Gay.
4 * 4 *
5 * Copyright (c) 1991, 2000, 2001 by Lucent Technologies. 5 * Copyright (c) 1991, 2000, 2001 by Lucent Technologies.
6 * 6 *
7 * Permission to use, copy, modify, and distribute this software for any 7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose without fee is hereby granted, provided that this entire notice 8 * purpose without fee is hereby granted, provided that this entire notice
9 * is included in all copies of any software which is or includes a copy 9 * is included in all copies of any software which is or includes a copy
10 * or modification of this software and in all copies of the supporting 10 * or modification of this software and in all copies of the supporting
(...skipping 2658 matching lines...) Expand 10 before | Expand all | Expand 10 after
2669 c = *++s; 2669 c = *++s;
2670 } 2670 }
2671 if (c >= '0' && c <= '9') { 2671 if (c >= '0' && c <= '9') {
2672 while(c == '0') 2672 while(c == '0')
2673 c = *++s; 2673 c = *++s;
2674 if (c > '0' && c <= '9') { 2674 if (c > '0' && c <= '9') {
2675 L = c - '0'; 2675 L = c - '0';
2676 s1 = s; 2676 s1 = s;
2677 while((c = *++s) >= '0' && c <= '9') { 2677 while((c = *++s) >= '0' && c <= '9') {
2678 if (L < (INT_MAX - 10) / 10) { 2678 if (L < (INT_MAX - 10) / 10) {
2679 » » » » » » L = 10*L + c - '0'; 2679 » » » » » » L = 10*L + (c - '0');
2680 } 2680 }
2681 } 2681 }
2682 if (s - s1 > 8 || L > 19999) 2682 if (s - s1 > 8 || L > 19999)
2683 /* Avoid confusion from exponents 2683 /* Avoid confusion from exponents
2684 * so large that e might overflow. 2684 * so large that e might overflow.
2685 */ 2685 */
2686 e = 19999; /* safe for 16 bit ints */ 2686 e = 19999; /* safe for 16 bit ints */
2687 else 2687 else
2688 e = (int)L; 2688 e = (int)L;
2689 if (esign) 2689 if (esign)
(...skipping 1700 matching lines...) Expand 10 before | Expand all | Expand 10 after
4390 #endif 4390 #endif
4391 Bfree(b); 4391 Bfree(b);
4392 *s = 0; 4392 *s = 0;
4393 *decpt = k + 1; 4393 *decpt = k + 1;
4394 if (rve) 4394 if (rve)
4395 *rve = s; 4395 *rve = s;
4396 return s0; 4396 return s0;
4397 } 4397 }
4398 4398
4399 } // namespace dmg_fp 4399 } // namespace dmg_fp
OLDNEW
« no previous file with comments | « no previous file | base/third_party/dmg_fp/exp_length.patch » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698