fix carry into uninitialized slots during printf floating point rounding
authorRich Felker <dalias@aerifal.cx>
Mon, 7 Apr 2014 05:36:40 +0000 (01:36 -0400)
committerRich Felker <dalias@aerifal.cx>
Wed, 16 Apr 2014 06:46:05 +0000 (02:46 -0400)
commitad0dfd04c2daf176235085c4e97f4d6ed3851654
treece69bb0689328810426b7be7ed89056c64019a1b
parentd636714704aede6f662c593d3d2d94e8a126b645
fix carry into uninitialized slots during printf floating point rounding

in cases where rounding caused a carry, the slot into which the carry
was taking place was unconditionally treated as valid, despite the
possibility that it could be a new slot prior to the beginning of the
existing non-rounded number. in theory this could lead to unbounded
runaway carry, but in order for that to happen, the whole
uninitialized buffer would need to have been pre-filled with 32-bit
integer values greater than or equal to 999999999.

patch based on proposed fix by Morten Welinder, who also discovered
and reported the bug.

(cherry picked from commit 109048e031f39fbb370211fde44ababf6c04c8fb)
src/stdio/vfprintf.c