Fix undefined double-to-int casts when encoding a number value (#5303) - #5309
Open
1820893135-pixel wants to merge 1 commit into
Open
1820893135-pixel wants to merge 1 commit into
1820893135-pixel wants to merge 1 commit into
Conversation
Three helpers in ecma-helpers-value.c converted a double to
ecma_integer_value_t and only then checked whether the result was in
range:
ecma_integer_value_t integer_value = (ecma_integer_value_t) ecma_number;
if ((ecma_number_t) integer_value == ecma_number && ...)
The cast is already undefined behaviour when the double is outside the
ecma_integer_value_t range, so the check comes too late. Under
-fsanitize=undefined (the OSS-Fuzz configuration) this traps:
ecma-helpers-value.c:572:40: runtime error: 1.5e+300 is outside the
range of representable values of type 'int'
Reached from ecma_make_number_value (line 572), ecma_update_float_number
(line 1021) and ecma_value_assign_number (line 1073); a value such as
1.5e300 walks from one to the next, so all three need the same treatment.
Move the range test in front of the cast in each function. Values
outside the range fall through to ecma_create_float_number(), which is
what happened for every value the existing round-trip check rejected.
JerryScript-DCO-1.0-Signed-off-by: 1820893135-pixel <1820893135@qq.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three helpers in
ecma-helpers-value.cconverted a double toecma_integer_value_tand only then tested the result:The cast is already undefined behaviour when the double is outside the
ecma_integer_value_trange, so the round-trip check cannot guard it. Under-fsanitize=undefined(the OSS-Fuzz configuration) this traps:The same pattern appears in all three functions, and a value such as
1.5e300walks from one to the next:
ecma_make_number_valueecma_update_float_numberecma_value_assign_numberThe reported input is a snapshot containing an oversized number literal, which
reaches
ecma_make_number_value()throughecma_snapshot_get_literal(); the value then flows intoecma_update_float_number()and
ecma_value_assign_number(), so fixing only the first site just moves thetrap to the next one.
Fix
Move the range test in front of the cast in each function. Values outside the
range fall through to
ecma_create_float_number(), which is what happened forevery value the round-trip check rejected.
Testing
Extends
tests/unit-core/test-api-value-type.cwith numbers outside theecma_integer_value_trange (1e308,-1e308,1.5e300,-1.5e10,1e18)that must round-trip as float values, plus a small integer that must still
behave as before.
Fixes #5303.