Buffer overflow possible with d2fixed() and friends

[paulharris]

Hi,

I know there are several other issues open on this related topic,
but I believe this would be slightly solution - hard fail please,

This bit of code will cause ryu to overflow its buffer:
d2fixed(1.0, 5000);
d2exp() will also do this,
both allocate a buffer = malloc(2000)
and then will blindly write as many characters as demanded by the precision parameter.

In my example requests 5000 precision, and ryu will try and write 5003 characters into the 2000 byte buffers.

I think you could set a hard max precision allowed, and abort() or fail or whatever.
Anything would be better than overflowing the buffer!

[ljluestc]

#include <stdlib.h>
#include <string.h>
#include <stdint.h>

// Define a maximum precision to prevent buffer overflows
#define MAX_PRECISION 1000

// Function to convert double to fixed-point representation with precision check
int d2fixed_buffered_n(double d, uint32_t precision, char* result) {
    if (precision > MAX_PRECISION) {
        precision = MAX_PRECISION;
    }
    
    // Implementation details for conversion, adjusted for safety
    // This is a placeholder for actual conversion logic
    int index = 0;
    // Convert the double to string with the limited precision
    // Here, we just simulate writing; actual implementation needed
    for (uint32_t i = 0; i < precision + 3; ++i) {  // +3 for decimal point, sign, and null terminator
        if (i < 2000) {  // Ensure we don't write past our buffer
            result[index++] = '0';  // Placeholder for actual digit conversion
        } else {
            break;  // Stop if we exceed buffer size
        }
    }
    result[index] = '\0';  // Null-terminate the string
    return index;
}

void d2fixed_buffered(double d, uint32_t precision, char* result) {
    const int len = d2fixed_buffered_n(d, precision, result);
    result[len] = '\0';
}

char* d2fixed(double d, uint32_t precision) {
    char* const buffer = (char*)malloc(2000);
    if (!buffer) {
        // Handle memory allocation failure
        return NULL;
    }
    const int index = d2fixed_buffered_n(d, precision, buffer);
    buffer[index] = '\0';
    return buffer;
}

// Similar function for d2exp()
int d2exp_buffered_n(double d, uint32_t precision, char* result) {
    if (precision > MAX_PRECISION) {
        precision = MAX_PRECISION;
    }
    
    int index = 0;
    // Simulate conversion to exponential form with precision limit
    for (uint32_t i = 0; i < precision + 6; ++i) {  // +6 for 'e', sign, exponent, '.', sign, and null terminator
        if (i < 2000) {
            result[index++] = '0';  // Placeholder
        } else {
            break;
        }
    }
    result[index] = '\0';
    return index;
}

void d2exp_buffered(double d, uint32_t precision, char* result) {
    const int len = d2exp_buffered_n(d, precision, result);
    result[len] = '\0';
}

char* d2exp(double d, uint32_t precision) {
    char* const buffer = (char*)malloc(2000);
    if (!buffer) {
        return NULL;
    }
    const int index = d2exp_buffered_n(d, precision, buffer);
    buffer[index] = '\0';
    return buffer;
}

int main() {
    double test_value = 1.0;
    uint32_t test_precision = 5000;
    
    char result[2000];
    d2fixed_buffered(test_value, test_precision, result);
    printf("d2fixed result: %s\n", result);

    char* dynamic_result = d2fixed(test_value, test_precision);
    if (dynamic_result) {
        printf("Dynamic d2fixed result: %s\n", dynamic_result);
        free(dynamic_result);
    }

    d2exp_buffered(test_value, test_precision, result);
    printf("d2exp result: %s\n", result);

    dynamic_result = d2exp(test_value, test_precision);
    if (dynamic_result) {
        printf("Dynamic d2exp result: %s\n", dynamic_result);
        free(dynamic_result);
    }

    return 0;
}