LibCrypto: Make constructing a BigInteger from string fallible

Previously, constructing a `UnsignedBigInteger::from_base()` could
produce an incorrect result if the input string contained a valid
Base36 digit that was out of range of the given base. The same method
would also crash if the input string contained an invalid Base36 digit.
An error is now returned in both these cases.

Constructing a BigFraction from string is now also fallible, so that we
can handle the case where we are given an input string with invalid
digits.

Userland/Libraries/LibCrypto/BigFraction/BigFraction.cpp

@@ -25,20 +25,18 @@ BigFraction::BigFraction(SignedBigInteger value)
 {
 }
 
-BigFraction::BigFraction(StringView sv)
+ErrorOr<BigFraction> BigFraction::from_string(StringView sv)
 {
-    // FIXME: This constructor is definitely fallible, errors should also be propagated
-    //  from both signed and unsigned version of from_base.
     auto maybe_dot_index = sv.find('.');
 
     auto integer_part_view = sv.substring_view(0, maybe_dot_index.value_or(sv.length()));
     auto fraction_part_view = maybe_dot_index.has_value() ? sv.substring_view(1 + *maybe_dot_index) : "0"sv;
 
-    auto integer_part = SignedBigInteger::from_base(10, integer_part_view);
-    auto fractional_part = SignedBigInteger::from_base(10, fraction_part_view);
+    auto integer_part = TRY(SignedBigInteger::from_base(10, integer_part_view));
+    auto fractional_part = TRY(SignedBigInteger::from_base(10, fraction_part_view));
     auto fraction_length = UnsignedBigInteger(static_cast<u64>(fraction_part_view.length()));
 
-    *this = BigFraction(move(integer_part)) + BigFraction(move(fractional_part), NumberTheory::Power("10"_bigint, move(fraction_length)));
+    return BigFraction(move(integer_part)) + BigFraction(move(fractional_part), NumberTheory::Power("10"_bigint, move(fraction_length)));
 }
 
 BigFraction BigFraction::operator+(BigFraction const& rhs) const

Userland/Libraries/LibCrypto/BigFraction/BigFraction.h

@@ -14,7 +14,7 @@ namespace Crypto {
 class BigFraction {
     // FIXME Make the whole API more error-friendly. This includes:
     //   - Propagating errors from BigIntegers
-    //   - Returns errors from both BigFraction(StringView) and BigFraction(numerator, denominator);
+    //   - Returns errors from BigFraction(numerator, denominator);
     //   - Duplicate fallible operators with a error-friendly version
 
 public:
@@ -27,9 +27,10 @@ public:
     BigFraction& operator=(Crypto::BigFraction const&) = default;
     BigFraction& operator=(Crypto::BigFraction&&) = default;
 
-    explicit BigFraction(StringView);
     explicit BigFraction(double);
 
+    static ErrorOr<BigFraction> from_string(StringView);
+
     BigFraction operator+(BigFraction const&) const;
     BigFraction operator-(BigFraction const&) const;
     BigFraction operator*(BigFraction const&) const;

Userland/Libraries/LibCrypto/BigInt/SignedBigInteger.cpp

@@ -35,7 +35,7 @@ size_t SignedBigInteger::export_data(Bytes data, bool remove_leading_zeros) cons
     return m_unsigned_data.export_data(bytes_view, remove_leading_zeros) + 1;
 }
 
-SignedBigInteger SignedBigInteger::from_base(u16 N, StringView str)
+ErrorOr<SignedBigInteger> SignedBigInteger::from_base(u16 N, StringView str)
 {
     auto sign = false;
     if (str.length() > 1) {
@@ -47,8 +47,8 @@ SignedBigInteger SignedBigInteger::from_base(u16 N, StringView str)
         if (maybe_sign == '+')
             str = str.substring_view(1);
     }
-    auto unsigned_data = UnsignedBigInteger::from_base(N, str);
-    return { move(unsigned_data), sign };
+    auto unsigned_data = TRY(UnsignedBigInteger::from_base(N, str));
+    return SignedBigInteger { move(unsigned_data), sign };
 }
 
 ErrorOr<String> SignedBigInteger::to_base(u16 N) const

Userland/Libraries/LibCrypto/BigInt/SignedBigInteger.h

@@ -63,7 +63,7 @@ public:
 
     size_t export_data(Bytes, bool remove_leading_zeros = false) const;
 
-    [[nodiscard]] static SignedBigInteger from_base(u16 N, StringView str);
+    [[nodiscard]] static ErrorOr<SignedBigInteger> from_base(u16 N, StringView str);
     [[nodiscard]] ErrorOr<String> to_base(u16 N) const;
     [[nodiscard]] ByteString to_base_deprecated(u16 N) const;
 
@@ -171,5 +171,5 @@ struct AK::Formatter<Crypto::SignedBigInteger> : AK::Formatter<Crypto::UnsignedB
 inline Crypto::SignedBigInteger
 operator""_sbigint(char const* string, size_t length)
 {
-    return Crypto::SignedBigInteger::from_base(10, { string, length });
+    return MUST(Crypto::SignedBigInteger::from_base(10, { string, length }));
 }

Userland/Libraries/LibCrypto/BigInt/UnsignedBigInteger.cpp

@@ -132,16 +132,22 @@ size_t UnsignedBigInteger::export_data(Bytes data, bool remove_leading_zeros) co
     return out;
 }
 
-UnsignedBigInteger UnsignedBigInteger::from_base(u16 N, StringView str)
+ErrorOr<UnsignedBigInteger> UnsignedBigInteger::from_base(u16 N, StringView str)
 {
     VERIFY(N <= 36);
     UnsignedBigInteger result;
     UnsignedBigInteger base { N };
 
-    for (auto& c : str) {
+    for (auto const& c : str) {
         if (c == '_')
             continue;
-        result = result.multiplied_by(base).plus(parse_ascii_base36_digit(c));
+        if (!is_ascii_base36_digit(c))
+            return Error::from_string_literal("Invalid Base36 digit");
+        auto digit = parse_ascii_base36_digit(c);
+        if (digit >= N)
+            return Error::from_string_literal("Base36 digit out of range");
+
+        result = result.multiplied_by(base).plus(digit);
     }
     return result;
 }

Userland/Libraries/LibCrypto/BigInt/UnsignedBigInteger.h

@@ -63,7 +63,7 @@ public:
 
     size_t export_data(Bytes, bool remove_leading_zeros = false) const;
 
-    [[nodiscard]] static UnsignedBigInteger from_base(u16 N, StringView str);
+    [[nodiscard]] static ErrorOr<UnsignedBigInteger> from_base(u16 N, StringView str);
     [[nodiscard]] ErrorOr<String> to_base(u16 N) const;
     [[nodiscard]] ByteString to_base_deprecated(u16 N) const;
 
@@ -161,5 +161,5 @@ struct AK::Formatter<Crypto::UnsignedBigInteger> : Formatter<StringView> {
 inline Crypto::UnsignedBigInteger
 operator""_bigint(char const* string, size_t length)
 {
-    return Crypto::UnsignedBigInteger::from_base(10, { string, length });
+    return MUST(Crypto::UnsignedBigInteger::from_base(10, { string, length }));
 }

Userland/Libraries/LibJS/Bytecode/ASTCodegen.cpp

@@ -273,12 +273,12 @@ Bytecode::CodeGenerationErrorOr<void> BigIntLiteral::generate_bytecode(Bytecode:
     auto integer = [&] {
         if (m_value[0] == '0' && m_value.length() >= 3)
             if (m_value[1] == 'x' || m_value[1] == 'X')
-                return Crypto::SignedBigInteger::from_base(16, m_value.substring(2, m_value.length() - 3));
+                return MUST(Crypto::SignedBigInteger::from_base(16, m_value.substring(2, m_value.length() - 3)));
         if (m_value[1] == 'o' || m_value[1] == 'O')
-            return Crypto::SignedBigInteger::from_base(8, m_value.substring(2, m_value.length() - 3));
+            return MUST(Crypto::SignedBigInteger::from_base(8, m_value.substring(2, m_value.length() - 3)));
         if (m_value[1] == 'b' || m_value[1] == 'B')
-            return Crypto::SignedBigInteger::from_base(2, m_value.substring(2, m_value.length() - 3));
-        return Crypto::SignedBigInteger::from_base(10, m_value.substring(0, m_value.length() - 1));
+            return MUST(Crypto::SignedBigInteger::from_base(2, m_value.substring(2, m_value.length() - 3)));
+        return MUST(Crypto::SignedBigInteger::from_base(10, m_value.substring(0, m_value.length() - 1)));
     }();
 
     generator.emit<Bytecode::Op::NewBigInt>(integer);

Userland/Libraries/LibJS/Runtime/Value.cpp

@@ -673,7 +673,7 @@ double string_to_number(StringView string)
 
     // 4. Return StringNumericValue of literal.
     if (result->base != 10) {
-        auto bigint = Crypto::UnsignedBigInteger::from_base(result->base, result->literal);
+        auto bigint = MUST(Crypto::UnsignedBigInteger::from_base(result->base, result->literal));
         return bigint.to_double();
     }
 
@@ -842,7 +842,7 @@ static Optional<BigInt*> string_to_bigint(VM& vm, StringView string)
 
     // 4. Let mv be the MV of literal.
     // 5. Assert: mv is an integer.
-    auto bigint = Crypto::SignedBigInteger::from_base(result->base, result->literal);
+    auto bigint = MUST(Crypto::SignedBigInteger::from_base(result->base, result->literal));
     if (result->is_negative && (bigint != BIGINT_ZERO))
         bigint.negate();
 

Userland/Libraries/LibWeb/HTML/StructuredSerialize.cpp

@@ -936,7 +936,8 @@ private:
         auto string_view = TRY(Bindings::throw_dom_exception_if_needed(vm, [&string]() {
             return string->utf8_string_view();
         }));
-        return JS::BigInt::create(vm, ::Crypto::SignedBigInteger::from_base(10, string_view.substring_view(0, string_view.length() - 1)));
+        auto bigint = MUST(::Crypto::SignedBigInteger::from_base(10, string_view.substring_view(0, string_view.length() - 1)));
+        return JS::BigInt::create(vm, bigint);
     }
 };