Fix array overflow in floating point parser

This commit is contained in:
Andreas Schwab 2010-09-01 12:38:44 -07:00 committed by Ulrich Drepper
parent f2933da978
commit a726d7960e
3 changed files with 10 additions and 2 deletions

View File

@ -1,3 +1,9 @@
2010-08-31 Andreas Schwab <schwab@redhat.com>
[BZ #7066]
* stdlib/strtod_l.c (____STRTOF_INTERNAL): Fix array overflow when
shifting retval into place.
2010-09-01 Ulrich Drepper <drepper@redhat.com>
* nis/rpcsvc/nis.h: Update copyright notice.

2
NEWS
View File

@ -9,7 +9,7 @@ Version 2.13
* The following bugs are resolved with this release:
10851, 11640, 11701, 11840, 11856, 11883, 11903, 11904
7066, 10851, 11640, 11701, 11840, 11856, 11883, 11903, 11904
* New Linux interfaces: prlimit, prlimit64, fanotify_init, fanotify_mark

View File

@ -1491,7 +1491,9 @@ ____STRTOF_INTERNAL (nptr, endptr, group, loc)
register int i;
(void) __mpn_lshift (&retval[used
/ BITS_PER_MP_LIMB],
retval, RETURN_LIMB_SIZE,
retval,
(RETURN_LIMB_SIZE
- used / BITS_PER_MP_LIMB),
used % BITS_PER_MP_LIMB);
for (i = used / BITS_PER_MP_LIMB - 1; i >= 0; --i)
retval[i] = 0;