File: fix-buffer-overflow.diff

package info (click to toggle)
mpfr4 3.1.2-2
  • links: PTS, VCS
  • area: main
  • in suites: jessie, jessie-kfreebsd
  • size: 9,224 kB
  • ctags: 5,207
  • sloc: ansic: 73,103; sh: 11,399; makefile: 227; perl: 47
file content (15 lines) | stat: -rw-r--r-- 687 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
--- a/src/strtofr.c
+++ b/src/strtofr.c
@@ -473,8 +473,10 @@
       /* prec bits corresponds to ysize limbs */
       ysize_bits = ysize * GMP_NUMB_BITS;
       /* and to ysize_bits >= prec > MPFR_PREC (x) bits */
-      y = MPFR_TMP_LIMBS_ALLOC (2 * ysize + 1);
-      y += ysize; /* y has (ysize+1) allocated limbs */
+      /* we need to allocate one more limb to work around bug
+         https://gmplib.org/list-archives/gmp-bugs/2013-December/003267.html */
+      y = MPFR_TMP_LIMBS_ALLOC (2 * ysize + 2);
+      y += ysize; /* y has (ysize+2) allocated limbs */
 
       /* pstr_size is the number of characters we read in pstr->mant
          to have at least ysize full limbs.