ulfjack / ryu

Converts floating point numbers to decimal strings
Apache License 2.0
1.19k stars 99 forks source link

Buffer overflow possible with d2fixed() and friends #197

Open paulharris opened 3 years ago

paulharris commented 3 years ago

Hi,

I know there are several other issues open on this related topic, but I believe this would be slightly solution - hard fail please,

This bit of code will cause ryu to overflow its buffer: d2fixed(1.0, 5000); d2exp() will also do this, both allocate a buffer = malloc(2000) and then will blindly write as many characters as demanded by the precision parameter.

In my example requests 5000 precision, and ryu will try and write 5003 characters into the 2000 byte buffers.

I think you could set a hard max precision allowed, and abort() or fail or whatever. Anything would be better than overflowing the buffer!