components/mpfr/patches/000-2.4.2-CVE-2014-9474.patch_1
changeset 7813 d18938ebcb0d
equal deleted inserted replaced
7812:ffe9ca8c9421 7813:d18938ebcb0d
       
     1 # Original patch for libmpfr 3.1.2 is here:
       
     2 # http://www.mpfr.org/mpfr-3.1.2/patch11
       
     3 # Backported to libmpfr 2.4.2.
       
     4 --- mpfr-2.4.2/strtofr.c	2009-11-29 18:43:08.000000000 -0800
       
     5 +++ mpfr-2.4.2/strtofr.c	2015-01-23 11:30:29.242406530 -0800
       
     6 @@ -464,8 +464,10 @@
       
     7        /* prec bits corresponds to ysize limbs */
       
     8        ysize_bits = ysize * BITS_PER_MP_LIMB;
       
     9        /* and to ysize_bits >= prec > MPFR_PREC (x) bits */
       
    10 -      y = (mp_limb_t*) MPFR_TMP_ALLOC ((2 * ysize + 1) * sizeof (mp_limb_t));
       
    11 -      y += ysize; /* y has (ysize+1) allocated limbs */
       
    12 +      /* we need to allocate one more limb to work around
       
    13 +       * https://gmplib.org/list-archives/gmp-bugs/2013-December/003267.html */
       
    14 +      y = (mp_limb_t*) MPFR_TMP_ALLOC ((2 * ysize + 2) * sizeof (mp_limb_t));
       
    15 +      y += ysize; /* y has (ysize+2) allocated limbs */
       
    16  
       
    17        /* pstr_size is the number of characters we read in pstr->mant
       
    18           to have at least ysize full limbs.