From a726d7960e8a4ac784131f591114a0ef14246d8b Mon Sep 17 00:00:00 2001
From: Andreas Schwab <schwab@redhat.com>
Date: Wed, 1 Sep 2010 12:38:44 -0700
Subject: Fix array overflow in floating point parser

---
 stdlib/strtod_l.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'stdlib')

diff --git a/stdlib/strtod_l.c b/stdlib/strtod_l.c
index cde1280e55..537d1fbc61 100644
--- a/stdlib/strtod_l.c
+++ b/stdlib/strtod_l.c
@@ -1491,7 +1491,9 @@ ____STRTOF_INTERNAL (nptr, endptr, group, loc)
 			  register int i;
 			  (void) __mpn_lshift (&retval[used
 						       / BITS_PER_MP_LIMB],
-					       retval, RETURN_LIMB_SIZE,
+					       retval,
+					       (RETURN_LIMB_SIZE
+						- used / BITS_PER_MP_LIMB),
 					       used % BITS_PER_MP_LIMB);
 			  for (i = used / BITS_PER_MP_LIMB - 1; i >= 0; --i)
 			    retval[i] = 0;
-- 
cgit v1.2.3