Skip to content

guard non-positive requested_digits in DigitGenCounted - #313

Merged
floitsch merged 1 commit into
google:masterfrom
Ramya-9353:fastdtoa-counted-nonpositive
Sep 8, 2026
Merged

guard non-positive requested_digits in DigitGenCounted#313
floitsch merged 1 commit into
google:masterfrom
Ramya-9353:fastdtoa-counted-nonpositive

Conversation

@Ramya-9353

Copy link
Copy Markdown
Contributor

ASan (Release build), FastDtoa(1234567.0, FAST_DTOA_PRECISION, 0, ...) into a one-byte buffer:

==ERROR: AddressSanitizer: heap-buffer-overflow
WRITE of size 1 ... 0 bytes after 1-byte region
    #0 double_conversion::FastDtoa(...) fast-dtoa.cc  (via DigitGenCounted)

DigitGenCounted's integral loop decrements requested_digits and only breaks on an exact 0, so a call with 0 (the first decrement makes it -1) never stops and emits every digit of the value past the end of the buffer; a negative count behaves the same way. DoubleToAscii special-cases PRECISION with 0 digits before it ever reaches here, and #306 added the matching guard to the Bignum slow path in GenerateCountedDigits, but the Grisu3 fast path, reachable through the installed FastDtoa API, was still unguarded.

Fix returns false with length 0 when requested_digits <= 0, before the loop runs, so nothing is written. Valid precision requests are unchanged. The regression test fences a one-byte buffer with a sentinel and checks it survives; the full ctest suite passes in Debug and Release.

@floitsch floitsch left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.
Thanks.

@floitsch
floitsch merged commit 65ea364 into google:master Sep 8, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants