quickjs-tart

commit 139099b697d1604aaf901f996156127b0a79c806
parent f1d331615d645e29bc719d7f81ad54ed46f9207b
Author: Saúl Ibarra Corretgé <s@saghul.net>
Date:   Fri, 22 Dec 2023 22:50:02 +0100

Fix UB in js_dtoa1

Diffstat:
M
quickjs/quickjs.c
 | 
4
+++-

1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/quickjs/quickjs.c b/quickjs/quickjs.c
@@ -11507,8 +11507,10 @@ static void js_dtoa1(char *buf, double d, int radix, int n_digits, int flags)
     } else if (flags == JS_DTOA_VAR_FORMAT) {
         int64_t i64;
         char buf1[70], *ptr;
+        if (d > (double)MAX_SAFE_INTEGER || d < (double)-MAX_SAFE_INTEGER)
+            goto generic_conv;
         i64 = (int64_t)d;
-        if (d != i64 || i64 > MAX_SAFE_INTEGER || i64 < -MAX_SAFE_INTEGER)
+        if (d != i64)
             goto generic_conv;
         /* fast path for integers */
         ptr = i64toa(buf1 + sizeof(buf1), i64, radix);