From 2dd3b632eaef88ee181982bbdb3c546f51a20dc2 Mon Sep 17 00:00:00 2001 From: Ramya Eliger Date: Tue, 28 Jul 2026 17:22:50 +0530 Subject: [PATCH] reject negative requested_digits in ToFixed --- double-conversion/double-to-string.cc | 1 + double-conversion/double-to-string.h | 1 + test/cctest/test-conversions.cc | 10 ++++++++++ 3 files changed, 12 insertions(+) diff --git a/double-conversion/double-to-string.cc b/double-conversion/double-to-string.cc index 9ea3d18d..ec1d37ec 100644 --- a/double-conversion/double-to-string.cc +++ b/double-conversion/double-to-string.cc @@ -219,6 +219,7 @@ bool DoubleToStringConverter::ToFixed(double value, return HandleSpecialValues(value, result_builder); } + if (requested_digits < 0) return false; if (requested_digits > kMaxFixedDigitsAfterPoint) return false; if (value >= kFirstNonFixed || value <= -kFirstNonFixed) return false; diff --git a/double-conversion/double-to-string.h b/double-conversion/double-to-string.h index 35449fee..48b0e2a7 100644 --- a/double-conversion/double-to-string.h +++ b/double-conversion/double-to-string.h @@ -288,6 +288,7 @@ class DoubleToStringConverter { // except for the following cases: // - the input value is special and no infinity_symbol or nan_symbol has // been provided to the constructor, + // - 'requested_digits' < 0, // - 'value' > 10^kMaxFixedDigitsBeforePoint, or // - 'requested_digits' > kMaxFixedDigitsAfterPoint. // The last two conditions imply that the result for non-special values never diff --git a/test/cctest/test-conversions.cc b/test/cctest/test-conversions.cc index 081d3ca3..f102e501 100644 --- a/test/cctest/test-conversions.cc +++ b/test/cctest/test-conversions.cc @@ -592,6 +592,16 @@ TEST(DoubleToFixed) { 9e59, DoubleToStringConverter::kMaxFixedDigitsAfterPoint + 1, &builder)); CHECK_EQ(0, builder.position()); + // A negative digit count would otherwise pad the result with + // -requested_digits characters, overrunning the caller's buffer. + builder.Reset(); + CHECK(!dc.ToFixed(1e-30, -1, &builder)); + CHECK_EQ(0, builder.position()); + + builder.Reset(); + CHECK(!dc.ToFixed(1e-30, -1000, &builder)); + CHECK_EQ(0, builder.position()); + builder.Reset(); CHECK(dc.ToFixed(3.0, 0, &builder)); CHECK_EQ("3", builder.Finalize());