Skip to content

[Repo Assist] fix: prevent int overflow (UB) in l_strtod/l_strtof exponent parsing#155

Draft
github-actions[bot] wants to merge 1 commit into
mainfrom
repo-assist/fix-strtod-exp-overflow-2026-04-26-943aebc0f49ddb09
Draft

[Repo Assist] fix: prevent int overflow (UB) in l_strtod/l_strtof exponent parsing#155
github-actions[bot] wants to merge 1 commit into
mainfrom
repo-assist/fix-strtod-exp-overflow-2026-04-26-943aebc0f49ddb09

Conversation

@github-actions
Copy link
Copy Markdown
Contributor

🤖 This is an automated pull request from Repo Assist.

Summary

Fixes signed-integer overflow (undefined behaviour) in l_strtod and l_strtof when parsing exponent strings with 10 or more digits (e.g., "1e999999999999999").

Root Cause

Both parsers accumulate the exponent into a plain int:

int exp = 0;
while (*s >= '0' && *s <= '9')
    exp = exp * 10 + (*s++ - '0');
if (exp > 308) exp = 308;

For a 10+ digit exponent string such as "1e99999999999", exp overflows int (signed-integer overflow = UB in C). An optimising compiler can miscompile this code by assuming the overflow never occurs.

Fix

Cap accumulation before the multiplication can overflow:

while (*s >= '0' && *s <= '9') {
    if (exp < 10000) exp = exp * 10 + (*s - '0');
    s++;
}

Same fix applied to l_strtof.

Tests

Regression tests added to tests/test_strings.c for both functions covering very-long exponent strings.

Test Status

./Taskfile test — all non-infrastructure tests pass.

Generated by 🌈 Repo Assist at {run-started}. Learn more.

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@1f672aef974f4246124860fc532f82fe8a93a57e

When parsing a very long exponent string such as '1e999999999999999',
the accumulation loop 'exp = exp * 10 + digit' would overflow the int
variable on the 10th or 11th digit, which is signed-integer overflow —
undefined behaviour in C. Optimising compilers can produce garbage
results or miscompile the surrounding code under the UB assumption.

Fix: cap the accumulation at 10000 before multiplying, so the value
never overflows. The existing downstream clamp (308 for double, 38 for
float) still limits the loop count as before.

Add two regression tests to test_strings.c covering the edge case for
both l_strtod and l_strtof.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants