asm/float.c: fix buffer underflow in float parsing
When we suffer an underflow that cross limb boundaries, it is possible
to end up with a stack underflow. Put in an explicit check for this
case (the mantissa will be zero in this case.)
https://bugzilla.nasm.us/show_bug.cgi?id=
3392445
Signed-off-by: H. Peter Anvin (Intel) <hpa@zytor.com>
diff --git a/asm/float.c b/asm/float.c
index
dcf69fea..
2965d3db 100644
--- a/asm/float.c
+++ b/asm/float.c
@@ -608,6 +608,8 @@ static void ieee_shr(fp_limb *mant, int i)
if (offs)
for (j = MANT_LIMBS-1; j >= offs; j--)
mant[j] = mant[j-offs];
+ } else if (MANT_LIMBS-1-offs < 0) {
+ j = MANT_LIMBS-1;
} else {
n = mant[MANT_LIMBS-1-offs] >> sr;
for (j = MANT_LIMBS-1; j > offs; j--) {