[PATCH] Fix strtold

[PATCH] Fix strtold

[Jakub Jelinek]

Hi!

There were 2 bugs in strtold{,_l} if RETURN_LIMB_SIZE > 2 (e.g. IEEE quad
long double on 32-bit architecture).
1) when clearing the rest of retval, it assumed there are at most 2 limbs
2) when shifting up by BITS_PER_MP_LIMB * empty bits, there was an
   off-by-one and no clearing of the bottom-most limbs

2004-03-24  Jakub Jelinek  <jakub@redhat.com>

	* stdlib/strtod_l.c (INTERNAL (__STRTOF)): Clear the rest of retval,
	not just one limb if RETURN_LIMB_SIZE > 2.  Fix shifting up if
	RETURN_LIMB_SIZE > 2.

--- libc/stdlib/strtod_l.c.jj	2004-03-24 13:45:24.000000000 -0500
+++ libc/stdlib/strtod_l.c	2004-03-24 14:14:18.000000000 -0500
@@ -1159,7 +1159,11 @@ INTERNAL (__STRTOF) (nptr, endptr, group
       memcpy (retval, num, numsize * sizeof (mp_limb_t));
 #if RETURN_LIMB_SIZE > 1
       if (numsize < RETURN_LIMB_SIZE)
+# if RETURN_LIMB_SIZE == 2
         retval[numsize] = 0;
+# else
+	MPN_ZERO (retval + numsize, RETURN_LIMB_SIZE - numsize);
+# endif
 #endif
     }
 
@@ -1465,8 +1469,10 @@ INTERNAL (__STRTOF) (nptr, endptr, group
 		      __mpn_lshift_1 (retval, RETURN_LIMB_SIZE,
 				      BITS_PER_MP_LIMB, 0);
 #else
-		      for (i = RETURN_LIMB_SIZE; i > empty; --i)
+		      for (i = RETURN_LIMB_SIZE - 1; i >= empty; --i)
 			retval[i] = retval[i - empty];
+		      while (i >= 0)
+			retval[i--] = 0;
 #endif
 		      for (i = numsize; i > 0; --i)
 			num[i + empty] = num[i - 1];

	Jakub

Re: [PATCH] Fix strtold

[Ulrich Drepper]

Applied.

-- 
➧ Ulrich Drepper ➧ Red Hat, Inc. ➧ 444 Castro St ➧ Mountain View, CA ❖

Re: [PATCH] Fix strtold

[Ulrich Drepper]

The patch looks fine.

-- 
➧ Ulrich Drepper ➧ Red Hat, Inc. ➧ 444 Castro St ➧ Mountain View, CA ❖

[PATCH] Fix strtold

[Jakub Jelinek]

Hi!

(echo '#include <stdlib.h>'; echo 'int main (void) { strtold("42.00000000000000000001", NULL); return 0; }') \
| gcc -O2 -D_GNU_SOURCE -o /tmp/test -m32 -xc -; valgrind --tool=memcheck /tmp/test
==31767== Memcheck, a memory error detector for x86-linux.
==31767== Copyright (C) 2002-2004, and GNU GPL'd, by Julian Seward et al.
==31767== Using valgrind-2.2.0, a program supervision framework for x86-linux.
==31767== Copyright (C) 2000-2004, and GNU GPL'd, by Julian Seward et al.
==31767== For more details, rerun with: -v
==31767==
==31767== Conditional jump or move depends on uninitialised value(s)
==31767==    at 0x3BB68F: __GI_____strtold_l_internal (in /lib/tls/libc-2.3.3.so)
==31767==    by 0x3B5117: __GI___strtold_internal (in /lib/tls/libc-2.3.3.so)
==31767==    by 0x80483A7: main (in /tmp/test)
==31767==
==31767== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 12 from 1)
==31767== malloc/free: in use at exit: 0 bytes in 0 blocks.
==31767== malloc/free: 0 allocs, 0 frees, 0 bytes allocated.
==31767== For a detailed leak analysis,  rerun with: --leak-check=yes
==31767== For counts of detected errors, rerun with: -v

I don't see anything that would make bits <= 0 and
if (bits + empty * BITS_PER_MP_LIMB <= MANT_DIG)
cases different from the last one regarding whether num needs to be
shifted up by (empty + 1) limbs up or not and it is IMHO consistent
with what e.g. densize == 2 handling does.  In case 2 there are 3 cases:
1) n1 = num[1]; n0 = num[0]; if numsize == densize
1) n1 = 0; n0 = num[0]; if num[0] >= d1
2) n1 = num[0]; n0 = 0; otherwise
Now, the check corresponding to num[0] >= d1 is done by
          if (__mpn_cmp (num, &den[densize - numsize], numsize) > 0)
            num[numsize++] = 0;
in the default case, so we need just the two cases
(if densize == numsize, shift up by 1 limb, otherwise shift up
by densize - numsize + 1 limbs).
Before the if (numsize < densize) test, num is valid from num[0]
up to num[numsize - 1].  After this if/else, we use
n0 = num[densize];
unconditionally, so num[densize] must be valid (and that's
densize - numsize + 1 limbs over what was defined before).
The following patch fixes the problem for me and make check passed
with it.

Do you agree?

2004-11-29  Jakub Jelinek  <jakub@redhat.com>

	* stdlib/strtod_l.c (INTERNAL (__STRTOF)): If densize > 2
	and numsize < densize, always shift num up by empty + 1
	limbs.

--- libc/stdlib/strtod_l.c.jj	2004-08-04 14:47:56.000000000 +0200
+++ libc/stdlib/strtod_l.c	2004-11-29 11:03:09.584378402 +0100
@@ -1442,15 +1442,10 @@ INTERNAL (__STRTOF) (nptr, endptr, group
 	  if (numsize < densize)
 	    {
 	      mp_size_t empty = densize - numsize;
+	      register int i;
 
 	      if (bits <= 0)
-		{
-		  register int i;
-		  for (i = numsize; i > 0; --i)
-		    num[i + empty] = num[i - 1];
-		  MPN_ZERO (num, empty + 1);
-		  exponent -= empty * BITS_PER_MP_LIMB;
-		}
+		exponent -= empty * BITS_PER_MP_LIMB;
 	      else
 		{
 		  if (bits + empty * BITS_PER_MP_LIMB <= MANT_DIG)
@@ -1459,7 +1454,6 @@ INTERNAL (__STRTOF) (nptr, endptr, group
 			 cannot optimize the `else' case that good and
 			 this reflects all currently used FLOAT types
 			 and GMP implementations.  */
-		      register int i;
 #if RETURN_LIMB_SIZE <= 2
 		      assert (empty == 1);
 		      __mpn_lshift_1 (retval, RETURN_LIMB_SIZE,
@@ -1470,9 +1464,6 @@ INTERNAL (__STRTOF) (nptr, endptr, group
 		      while (i >= 0)
 			retval[i--] = 0;
 #endif
-		      for (i = numsize; i > 0; --i)
-			num[i + empty] = num[i - 1];
-		      MPN_ZERO (num, empty + 1);
 		    }
 		  else
 		    {
@@ -1492,6 +1483,9 @@ INTERNAL (__STRTOF) (nptr, endptr, group
 		    }
 		  bits += empty * BITS_PER_MP_LIMB;
 		}
+	      for (i = numsize; i > 0; --i)
+		num[i + empty] = num[i - 1];
+	      MPN_ZERO (num, empty + 1);
 	    }
 	  else
 	    {

	Jakub