[libc-commits] [PATCH] D158118: [libc] Fix HPD on extremely long numbers

[Michael Jones via Phabricator via libc-commits]

michaelrj created this revision.
michaelrj added reviewers: sivachandra, lntue.
Herald added projects: libc-project, All.
Herald added a subscriber: libc-commits.
michaelrj requested review of this revision.

The fuzzer found that a 100,000 digit number could possibly return an
incorrect result. This patch fixes the issue.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D158118

Files:
  libc/src/__support/high_precision_decimal.h


Index: libc/src/__support/high_precision_decimal.h
===================================================================
--- libc/src/__support/high_precision_decimal.h
+++ libc/src/__support/high_precision_decimal.h
@@ -334,13 +334,24 @@
     if ((*numString | 32) == 'e') {
       ++numString;
       if (isdigit(*numString) || *numString == '+' || *numString == '-') {
-        int32_t add_to_exp = strtointeger<int32_t>(numString, 10);
-        if (add_to_exp > 100000) {
-          add_to_exp = 100000;
-        } else if (add_to_exp < -100000) {
-          add_to_exp = -100000;
+        auto result = strtointeger<int32_t>(numString, 10);
+        if (result.has_error()) {
+          // TODO: handle error
         }
-        this->decimal_point += add_to_exp;
+        int32_t add_to_exponent = result.value;
+
+        // Here we do this operation as int64 to avoid overflow.
+        int64_t temp_exponent = static_cast<int64_t>(this->decimal_point) +
+                                static_cast<int64_t>(add_to_exponent);
+
+        // Theoretically these numbers should be MAX_EXPONENT for long double,
+        // but that should be ~16,000 which is much less than 100,000.
+        if (temp_exponent > 100000) {
+          temp_exponent = 100000;
+        } else if (temp_exponent < -100000) {
+          temp_exponent = -100000;
+        }
+        this->decimal_point = static_cast<int32_t>(temp_exponent);
       }
     }
 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D158118.550887.patch
Type: text/x-patch
Size: 1441 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/libc-commits/attachments/20230816/9010c16e/attachment.bin>