From 5f353d1e05659d8515511f28b875b9fd10c1a661 Mon Sep 17 00:00:00 2001 From: Andreas Schwab Date: Wed, 1 Sep 2010 12:38:44 -0700 Subject: [PATCH] Fix array overflow in floating point parser (cherry picked from commit a726d7960e8a4ac784131f591114a0ef14246d8b) --- ChangeLog | 6 ++++++ stdlib/strtod_l.c | 4 +++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index c8bdd6dba20..5b04f1b5ad1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2010-08-31 Andreas Schwab + + [BZ #7066] + * stdlib/strtod_l.c (____STRTOF_INTERNAL): Fix array overflow when + shifting retval into place. + 2010-09-14 Ulrich Drepper * resolv/res_init.c (__res_vinit): Count the default server we added. diff --git a/stdlib/strtod_l.c b/stdlib/strtod_l.c index 9ddfa3fa663..099fcf751e4 100644 --- a/stdlib/strtod_l.c +++ b/stdlib/strtod_l.c @@ -1491,7 +1491,9 @@ ____STRTOF_INTERNAL (nptr, endptr, group, loc) register int i; (void) __mpn_lshift (&retval[used / BITS_PER_MP_LIMB], - retval, RETURN_LIMB_SIZE, + retval, + (RETURN_LIMB_SIZE + - used / BITS_PER_MP_LIMB), used % BITS_PER_MP_LIMB); for (i = used / BITS_PER_MP_LIMB - 1; i >= 0; --i) retval[i] = 0; -- 2.47.2