* [musl] [PATCH] printf: Fix int overflow in rounding calculation
@ 2024-04-14 17:53 Peter Ammon
0 siblings, 0 replies; only message in thread
From: Peter Ammon @ 2024-04-14 17:53 UTC (permalink / raw)
To: musl
In printf float formatting, a calculation of digits to round may trigger signed int overflow, if the precision is large and the exponent is large and negative. For example, `printf("%.*g", INT_MAX, 1e-100)` will reproduce it.
The overflow case corresponds to a huge number of digits after the decimal, which means no rounding is required, so I opted to saturate j at INT_MAX. Using a wider type is an alternative.
Note that p is non-negative, so underflow is impossible.
---
src/stdio/vfprintf.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/stdio/vfprintf.c b/src/stdio/vfprintf.c
index 497c5e19..eb4c755a 100644
--- a/src/stdio/vfprintf.c
+++ b/src/stdio/vfprintf.c
@@ -307,7 +307,8 @@ static int fmt_fp(FILE *f, long double y, int w, int p, int fl, int t)
else e=0;
/* Perform rounding: j is precision after the radix (possibly neg) */
- j = p - ((t|32)!='f')*e - ((t|32)=='g' && p);
+ i = ((t|32)!='f')*e + ((t|32)=='g' && p);
+ j = (i < 0 && p > INT_MAX+i) ? INT_MAX : p-i;
if (j < 9*(z-r-1)) {
uint32_t x;
/* We avoid C's broken division of negative numbers */
--
2.39.2
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2024-04-14 17:54 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-04-14 17:53 [musl] [PATCH] printf: Fix int overflow in rounding calculation Peter Ammon
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).