This is the mail archive of the libc-alpha@sourceware.org mailing list for the glibc project.

Index Nav: Message Nav: [Date Index] [Subject Index] [Author Index] [Thread Index] [Date Prev] [Date Next] [Thread Prev] [Thread Next] [Raw text]

# Re: [PATCH] Fix potential access beyond array bounds in m1np

```On Fri, Dec 28, 2012 at 01:31:55PM +0100, Andreas Jaeger wrote:
>
> So, what should happen for p >= 18? Shouldn't this be an assert?

The array is an attempt at trying to reduce the number of Taylor
series iterations needed for the given precision.  p >= 18 means that
we don't have data for the number in question.  I think the
conservative thing to do here would be to just move on with the
polynomial expansion.  What do you think?

> An additional note: This would need a comment to state why it checks
> against 18.
>

OK, here's v2:

diff --git a/sysdeps/ieee754/dbl-64/mpexp.c b/sysdeps/ieee754/dbl-64/mpexp.c
index c5a0283..7b31110 100644
--- a/sysdeps/ieee754/dbl-64/mpexp.c
+++ b/sysdeps/ieee754/dbl-64/mpexp.c
@@ -71,7 +71,12 @@ __mpexp(mp_no *x, mp_no *y, int p) {
for (i=2; i<=p; i++) { if (X[i]!=ZERO)  break; }
if (i==p+1)  { m2--;  a *= TWO; }
}
-  if ((m=m1+m2) <= 0) {
+
+  /* m1np is used to determine if we could reduce the number of iterations of
+     the polynomial expansion.  We only have data up to precision of 18 and
+     anything equal to or greater than that will result in an access beyond
+     array bounds.  */
+  if (__glibc_unlikely (p < 18 && (m=m1+m2) <= 0)) {
m=0;  a=ONE;
for (i=n-1; i>0; i--,n--) { if (m1np[i][p]+m2>0)  break; }
}

```

Index Nav: Message Nav: [Date Index] [Subject Index] [Author Index] [Thread Index] [Date Prev] [Date Next] [Thread Prev] [Thread Next]