mirror of
https://github.com/RGBCube/serenity
synced 2025-07-27 21:37:35 +00:00
LibJS: Make int_part a double in StringPrototype::to_string
u64 is not big enough to hold extremely large numbers, such as 4.192938423e+54. This would cause an integer underflow on the radix index when performing something like `toString(36)` and thus cause an OOB Array read.
This commit is contained in:
parent
52a6f1ff8c
commit
ddc7bedca6
2 changed files with 59 additions and 2 deletions
|
@ -459,7 +459,7 @@ JS_DEFINE_NATIVE_FUNCTION(NumberPrototype::to_string)
|
|||
if (negative)
|
||||
number *= -1;
|
||||
|
||||
u64 int_part = floor(number);
|
||||
double int_part = floor(number);
|
||||
double decimal_part = number - int_part;
|
||||
|
||||
int radix = (int)radix_mv;
|
||||
|
@ -469,8 +469,9 @@ JS_DEFINE_NATIVE_FUNCTION(NumberPrototype::to_string)
|
|||
backwards_characters.append('0');
|
||||
} else {
|
||||
while (int_part > 0) {
|
||||
backwards_characters.append(digits[int_part % radix]);
|
||||
backwards_characters.append(digits[floor(fmod(int_part, radix))]);
|
||||
int_part /= radix;
|
||||
int_part = floor(int_part);
|
||||
}
|
||||
}
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue