musl - OOB array access in decfloat?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <XXwtZ3wyJflGrejmDHhZMYZ69gbzsyL-Auk9Qp3nwqPEAzPOqDLzANWYzmRH4c5wIualAo_6rZbcQCr7PIfWarO_Si8imJCOeXTusDnMoNg=@egori.ch>
Date: Tue, 22 Sep 2026 18:00:25 +0000
From: Ivan Egorov <me@...ri.ch>
To: "musl@...ts.openwall.com" <musl@...ts.openwall.com>
Subject: OOB array access in decfloat?

hi folks,

i believe i accidentally came across an out-of-bounds access in `strtod`, or rather in `decfloat` on line 259 of `floatscan.c`:

`if ((a+i & MASK)==z) x[(z=(z+1 & MASK))-1] = 0;`

with z=KMAX-1 this rolls to zero in assignment and to -1 afterwards.

A (Claude-assisted) minimal reproduction, triggering gcc's ASan is in the attached .tgz. The test case originates in parse-number-fxx-test-data set. I originally found this bug by compiling the implementation with tcc 0.9.27 which does not allocate stack variables into registers, and hence garbled a neighbor and (unlike gcc) returned wrong answer for this test.

A minimal patch (also in the archive):

`if ((a+i & MASK)==z) x[(z=(z+1 & MASK))-1 & MASK] = 0;`

Kind regards,
Ivan
Content of type "text/html" skipped

Download attachment "musl-strtod-oob.tar.gz" of type "application/gzip" (3206 bytes)

Download attachment "publickey - me@...ri.ch - 0x769B367F.asc" of type "application/pgp-keys" (628 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (344 bytes)

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.