romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 21:33:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

printf: fix floating point buffer overflow issues

Browse source 
... and add a bunch of floating point printf tests
This commit is contained in:
Daniel Stenberg 2016-11-08 15:32:37 +01:00
parent 60450d507f
commit 3ab3c16db6
3 changed files with 152 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

20
lib/mprintf.c
View file

@ -92,7 +92,8 @@
# define mp_uintmax_t unsigned long
#endif
#define BUFFSIZE 256 /* buffer for long-to-str and float-to-str calcs */
#define BUFFSIZE 326 /* buffer for long-to-str and float-to-str calcs, should
fit negative DBL_MAX (317 letters) */
#define MAX_PARAMETERS 128 /* lame static limit */
#ifdef __AMIGA__
@ -916,12 +917,25 @@ static int dprintf_formatf(
*fptr = 0;
if(width >= 0) {
if(width >= (long)sizeof(work))
width = sizeof(work)-1;
/* RECURSIVE USAGE */
len = curl_msnprintf(fptr, left, "%ld", width);
fptr += len;
left -= len;
}
if(prec >= 0) {
/* for each digit in the integer part, we can have one less
precision */
size_t maxprec = sizeof(work) - 2;
double val = p->data.dnum;
while(val >= 10.0) {
val /= 10;
maxprec--;
}
if(prec > (long)maxprec)
prec = maxprec-1;
/* RECURSIVE USAGE */
len = curl_msnprintf(fptr, left, ".%ld", prec);
fptr += len;
@ -941,7 +955,9 @@ static int dprintf_formatf(
/* NOTE NOTE NOTE!! Not all sprintf implementations return number of
output characters */
(sprintf)(work, formatbuf, p->data.dnum);
#ifdef CURLDEBUG
assert(strlen(work) <= sizeof(work));
#endif
for(fptr=work; *fptr; fptr++)
OUTCHAR(*fptr);
}