From cea6cf8a5e87127eccc8214cbffa2d4c8aae8527 Mon Sep 17 00:00:00 2001 From: Damien George Date: Tue, 15 Mar 2016 12:21:56 +0000 Subject: py/formatfloat: Fix buffer overflow when formatting tiny numbers. --- py/formatfloat.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'py/formatfloat.c') diff --git a/py/formatfloat.c b/py/formatfloat.c index b2107316f0..f7762b07dd 100644 --- a/py/formatfloat.c +++ b/py/formatfloat.c @@ -27,6 +27,7 @@ #include "py/mpconfig.h" #if MICROPY_FLOAT_IMPL != MICROPY_FLOAT_IMPL_NONE +#include #include #include #include "py/formatfloat.h" @@ -210,13 +211,15 @@ int mp_format_float(FPTYPE f, char *buf, size_t buf_size, char fmt, int prec, ch dec = -1; *s++ = first_dig; - if (prec + e + 1 > buf_remaining) { - prec = buf_remaining - e - 1; - } - if (org_fmt == 'g') { prec += (e - 1); } + + // truncate precision to prevent buffer overflow + if (prec + 2 > buf_remaining) { + prec = buf_remaining - 2; + } + num_digits = prec; if (num_digits) { *s++ = '.'; @@ -390,6 +393,9 @@ int mp_format_float(FPTYPE f, char *buf, size_t buf_size, char fmt, int prec, ch } *s = '\0'; + // verify that we did not overrun the input buffer + assert((size_t)(s + 1 - buf) <= buf_size); + return s - buf; } -- cgit v1.2.3