This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
Re: [PATCH] Fix potential access beyond array bounds in m1np
On Fri, Dec 28, 2012 at 01:31:55PM +0100, Andreas Jaeger wrote:
>
> So, what should happen for p >= 18? Shouldn't this be an assert?
The array is an attempt at trying to reduce the number of Taylor
series iterations needed for the given precision. p >= 18 means that
we don't have data for the number in question. I think the
conservative thing to do here would be to just move on with the
polynomial expansion. What do you think?
> An additional note: This would need a comment to state why it checks
> against 18.
>
OK, here's v2:
diff --git a/sysdeps/ieee754/dbl-64/mpexp.c b/sysdeps/ieee754/dbl-64/mpexp.c
index c5a0283..7b31110 100644
--- a/sysdeps/ieee754/dbl-64/mpexp.c
+++ b/sysdeps/ieee754/dbl-64/mpexp.c
@@ -71,7 +71,12 @@ __mpexp(mp_no *x, mp_no *y, int p) {
for (i=2; i<=p; i++) { if (X[i]!=ZERO) break; }
if (i==p+1) { m2--; a *= TWO; }
}
- if ((m=m1+m2) <= 0) {
+
+ /* m1np is used to determine if we could reduce the number of iterations of
+ the polynomial expansion. We only have data up to precision of 18 and
+ anything equal to or greater than that will result in an access beyond
+ array bounds. */
+ if (__glibc_unlikely (p < 18 && (m=m1+m2) <= 0)) {
m=0; a=ONE;
for (i=n-1; i>0; i--,n--) { if (m1np[i][p]+m2>0) break; }
}