reject negative requested_digits in ToFixed

double-conversion/double-to-string.cc

@@ -219,6 +219,7 @@ bool DoubleToStringConverter::ToFixed(double value,
     return HandleSpecialValues(value, result_builder);
   }
 
+  if (requested_digits < 0) return false;
   if (requested_digits > kMaxFixedDigitsAfterPoint) return false;
   if (value >= kFirstNonFixed || value <= -kFirstNonFixed) return false;
 

double-conversion/double-to-string.h

@@ -288,6 +288,7 @@ class DoubleToStringConverter {
   // except for the following cases:
   //   - the input value is special and no infinity_symbol or nan_symbol has
   //     been provided to the constructor,
+  //   - 'requested_digits' < 0,
   //   - 'value' > 10^kMaxFixedDigitsBeforePoint, or
   //   - 'requested_digits' > kMaxFixedDigitsAfterPoint.
   // The last two conditions imply that the result for non-special values never

test/cctest/test-conversions.cc

@@ -592,6 +592,16 @@ TEST(DoubleToFixed) {
       9e59, DoubleToStringConverter::kMaxFixedDigitsAfterPoint + 1, &builder));
   CHECK_EQ(0, builder.position());
 
+  // A negative digit count would otherwise pad the result with
+  // -requested_digits characters, overrunning the caller's buffer.
+  builder.Reset();
+  CHECK(!dc.ToFixed(1e-30, -1, &builder));
+  CHECK_EQ(0, builder.position());
+
+  builder.Reset();
+  CHECK(!dc.ToFixed(1e-30, -1000, &builder));
+  CHECK_EQ(0, builder.position());
+
   builder.Reset();
   CHECK(dc.ToFixed(3.0, 0, &builder));
   CHECK_EQ("3", builder.Finalize());