[PATCH] Handle oveflow in O(U)String::toInt() functions

[Zolnai Tamás (via_Code_Review)]

Hi,

I have submitted a patch for review:

    https://gerrit.libreoffice.org/3029

To pull it, you can do:

    git pull ssh://gerrit.libreoffice.org:29418/core refs/changes/29/3029/1

Handle oveflow in O(U)String::toInt() functions

Return 0 when overflow.
The base idea in unsigned case is checking wheather
(Max-nDigit)/nRadix < n
But for efficency, take out nDiv = Max/nRadix from loop
and corrigate it with -1 if needed.
In signed case use minimum value if the number is negativ.

Change-Id: I5b77580adbf12421b6c4b785ba9bc2a080accba2
---
M sal/rtl/strtmpl.cxx
1 file changed, 8 insertions(+), 0 deletions(-)



diff --git a/sal/rtl/strtmpl.cxx b/sal/rtl/strtmpl.cxx
index 69bd5ee..6859af1 100644
--- a/sal/rtl/strtmpl.cxx
+++ b/sal/rtl/strtmpl.cxx
@@ -941,11 +941,15 @@
             bNeg = sal_False;
         }
 
+        const T nDiv = bNeg ? -(std::numeric_limits<T>::min()/nRadix) : (std::numeric_limits<T>::max()/nRadix);
+        const sal_Int16 nMod = bNeg ? -(std::numeric_limits<T>::min()%nRadix) : (std::numeric_limits<T>::max()%nRadix);
         while ( *pStr )
         {
             nDigit = rtl_ImplGetDigit( IMPL_RTL_USTRCODE( *pStr ), nRadix );
             if ( nDigit < 0 )
                 break;
+            if( ( nMod < nDigit ? nDiv-1 : nDiv ) < n )
+                return 0;
 
             n *= nRadix;
             n += nDigit;
@@ -978,11 +982,15 @@
         if ( *pStr == '+' )
             ++pStr;
 
+        const T nDiv = std::numeric_limits<T>::max()/nRadix;
+        const sal_Int16 nMod = std::numeric_limits<T>::max()%nRadix;
         while ( *pStr )
         {
             nDigit = rtl_ImplGetDigit( IMPL_RTL_USTRCODE( *pStr ), nRadix );
             if ( nDigit < 0 )
                 break;
+            if( ( nMod < nDigit ? nDiv-1 : nDiv ) < n )
+                return 0;
 
             n *= nRadix;
             n += nDigit;

-- 
To view, visit https://gerrit.libreoffice.org/3029
To unsubscribe, visit https://gerrit.libreoffice.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I5b77580adbf12421b6c4b785ba9bc2a080accba2
Gerrit-PatchSet: 1
Gerrit-Project: core
Gerrit-Branch: master
Gerrit-Owner: Zolnai Tamás <zolnaitamas2000 at gmail.com>