com php-src: fix stack overflow in php_intlog10abs() : ext/standard/math.c
| From: | Nuno Lopes | Date: | Fri, 11 May 2012 16:50:29 +0000 |
| Subject: | com php-src: fix stack overflow in php_intlog10abs() : ext/standard/math.c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-69035@lists.php.net to get a copy of this message | ||
Commit: 5c87ca2d2770e18c385d4b770123b9b21eeaa053
Author: Nuno Lopes <nlopess@php.net> Fri, 11 May 2012 12:50:29 -0400
Parents: d0d7340d50f178691c8e436391168cf6cc1fea3e
Branches: master
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=5c87ca2d2770e18c385d4b770123b9b21eeaa053
Log:
fix stack overflow in php_intlog10abs()
bug uncovered by LLVM/clang's new -fbounds-checking switch
this patch fixes a crash in ext/standard/tests/math/round_large_exp.phpt
Changed paths:
M ext/standard/math.c
Diff:
diff --git a/ext/standard/math.c b/ext/standard/math.c
index 302fbda..65187f6 100644
--- a/ext/standard/math.c
+++ b/ext/standard/math.c
@@ -37,7 +37,7 @@ static inline int php_intlog10abs(double value) {
int result;
value = fabs(value);
- if (value < 1e-8 || value > 1e23) {
+ if (value < 1e-8 || value > 1e22) {
result = (int)floor(log10(value));
} else {
static const double values[] = {
@@ -46,7 +46,7 @@ static inline int php_intlog10abs(double value) {
1e8, 1e9, 1e10, 1e11, 1e12, 1e13, 1e14, 1e15,
1e16, 1e17, 1e18, 1e19, 1e20, 1e21, 1e22};
/* Do a binary search with 5 steps */
- result = 16;
+ result = 15;
if (value < values[result]) {
result -= 8;
} else {