diff options
| author | Eike Rathke <erack@redhat.com> | 2020-10-18 00:12:42 +0200 |
|---|---|---|
| committer | Eike Rathke <erack@redhat.com> | 2020-10-18 01:46:58 +0200 |
| commit | 6ccf4dd2224e4beb567365903249858a2ca00082 (patch) | |
| tree | 3fddcb6359af8b8c8fea79cbf99da7bca6e08565 /sal | |
| parent | 3371e11d23635c69f242507a33b60daf2c21b433 (diff) | |
Limit nDecPlaces to a sensible value [-20, 20]
Protect against callers using for example rtl_math_StringFormat_F
with rtl_math_DecimalPlaces_Max in worst case..
Change-Id: I9f143df6ae67b22e7732547c0f7a53b498caf2b8
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/104472
Reviewed-by: Eike Rathke <erack@redhat.com>
Tested-by: Jenkins
Diffstat (limited to 'sal')
| -rw-r--r-- | sal/rtl/math.cxx | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/sal/rtl/math.cxx b/sal/rtl/math.cxx index b7dc1cbbc7f0..fe81f4c5a7f7 100644 --- a/sal/rtl/math.cxx +++ b/sal/rtl/math.cxx @@ -433,6 +433,12 @@ void doubleToString(typename T::String ** pResult, break; } + // Too large values for nDecPlaces make no sense; it might also be + // rtl_math_DecimalPlaces_Max was passed with rtl_math_StringFormat_F or + // others, but we don't want to allocate/deallocate 2GB just to fill it + // with trailing '0' characters.. + nDecPlaces = std::max<sal_Int32>(std::min<sal_Int32>(nDecPlaces, 20), -20); + sal_Int32 nDigits = nDecPlaces + 1; if (eFormat == rtl_math_StringFormat_F) |