This is the mail archive of the glibc-bugs@sourceware.org mailing list for the glibc project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

[Bug math/16962] New: nan function unbounded stack allocation


https://sourceware.org/bugzilla/show_bug.cgi?id=16962

            Bug ID: 16962
           Summary: nan function unbounded stack allocation
           Product: glibc
           Version: 2.19
            Status: NEW
          Severity: normal
          Priority: P2
         Component: math
          Assignee: unassigned at sourceware dot org
          Reporter: jsm28 at gcc dot gnu.org

The nan function (nanf, nanl likewise) does:

  if (tagp[0] != '\0')
    {
      char buf[6 + strlen (tagp)];
      sprintf (buf, "NAN(%s)", tagp);
      return strtod (buf, NULL);
    }

This is an unbounded stack allocation based on the length of the argument. 
Instead the relevant code from strtod should be refactored so that the right
NaN can be returned without needing to copy the string at all.  (See also bug
16961 for another issue with this code.)

-- 
You are receiving this mail because:
You are on the CC list for the bug.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]