TonBERRY/micropython
3
0
Fork 0
Code Pull Requests Activity

py/formatfloat: Fix buffer overflow when formatting tiny numbers.

Browse Source
This commit is contained in:
Damien George
2016-03-15 12:21:56 +00:00
parent 0d1f8868b6
commit cea6cf8a5e
2 changed files with 26 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
py/formatfloat.c
View File

@@ -27,6 +27,7 @@
#include "py/mpconfig.h"
#if MICROPY_FLOAT_IMPL != MICROPY_FLOAT_IMPL_NONE
#include <assert.h>
#include <stdlib.h>
#include <stdint.h>
#include "py/formatfloat.h"
@@ -210,13 +211,15 @@ int mp_format_float(FPTYPE f, char *buf, size_t buf_size, char fmt, int prec, ch
dec = -1;
*s++ = first_dig;
if (prec + e + 1 > buf_remaining) {
prec = buf_remaining - e - 1;
}
if (org_fmt == 'g') {
prec += (e - 1);
}
// truncate precision to prevent buffer overflow
if (prec + 2 > buf_remaining) {
prec = buf_remaining - 2;
}
num_digits = prec;
if (num_digits) {
*s++ = '.';
@@ -390,6 +393,9 @@ int mp_format_float(FPTYPE f, char *buf, size_t buf_size, char fmt, int prec, ch
}
*s = '\0';
// verify that we did not overrun the input buffer
assert((size_t)(s + 1 - buf) <= buf_size);
return s - buf;
}