Module: wine Branch: master Commit: 65642f4bb7d9c8bfb9f16f6f59d4c06271431f43 URL: https://source.winehq.org/git/wine.git/?a=commit;h=65642f4bb7d9c8bfb9f16f6f5...
Author: Piotr Caban piotr@codeweavers.com Date: Fri May 1 11:58:11 2020 +0200
msvcrt: Avoid depending on signed variable overflow in parse_double.
Signed-off-by: Piotr Caban piotr@codeweavers.com Signed-off-by: Alexandre Julliard julliard@winehq.org
---
dlls/msvcrt/string.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/dlls/msvcrt/string.c b/dlls/msvcrt/string.c index b2bc3e9c2e..31ed4e2181 100644 --- a/dlls/msvcrt/string.c +++ b/dlls/msvcrt/string.c @@ -549,8 +549,10 @@ static double strtod16(MSVCRT_wchar_t get(void *ctx), void unget(void *ctx), } if(nch>='0' && nch<='9') { while(nch>='0' && nch<='9') { - if(e>INT_MAX/10 || (e=e*10+nch-'0')<0) + if(e>INT_MAX/10 || e*10>INT_MAX-nch+'0') e = INT_MAX; + else + e = e*10+nch-'0'; nch = get(ctx); } if((nch!=MSVCRT_WEOF) && (nch < '0' || nch > '9')) unget(ctx); @@ -827,8 +829,10 @@ double parse_double(MSVCRT_wchar_t (*get)(void *ctx), void (*unget)(void *ctx),
if(nch>='0' && nch<='9') { while(nch>='0' && nch<='9') { - if(e>INT_MAX/10 || (e=e*10+nch-'0')<0) + if(e>INT_MAX/10 || e*10>INT_MAX-nch+'0') e = INT_MAX; + else + e = e*10+nch-'0'; nch = get(ctx); } if(nch != MSVCRT_WEOF) unget(ctx);