After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 314326 - integer overflow in xmlXPathFormatNumber
integer overflow in xmlXPathFormatNumber
Status: VERIFIED FIXED
Product: libxml2
Classification: Platform
Component: general
2.6.20
Other All
: Normal normal
: ---
Assigned To: Daniel Veillard
libxml QA maintainers
Depends on:
Blocks:
 
 
Reported: 2005-08-23 23:22 UTC by Kevin Puetz
Modified: 2009-08-15 18:40 UTC
See Also:
GNOME target: ---
GNOME version: ---



Description Kevin Puetz 2005-08-23 23:22:13 UTC
Please describe the problem:
When trying printing a number that happened to be integer (number == ((int)
number)), xmlXPathFormatNumber does a bunch of divide/modulo arithmetic to
generate the characters (instead of deferring to printf like it does for numbers
with a floating-point portion).

This code has an overflow for the case of -2147483648 (0x80000000), since that
number has the strange property that -x == x (for machines where sizeof(int) ==
4). This means that the code doing 
if(val  < 0) val = -val;
in an attempt to get an absolute value fails, and val is still negative.
Therefor, val % 10 can be negative (on x86, at least, it is). So when it adds
'0' + val % 10 to get digits, the results are... interesting :-)


Steps to reproduce:
1. ./testXPath 'string(-2147483648.0)'


Actual results:
Object is a string : -./,),(-*,(

Expected results:
Object is a string : -2147483648

Does this happen every time?
yes

Other information:
Comment 1 Daniel Veillard 2005-08-24 08:10:13 UTC
I can reproduce it in head, confirmed,

Daniel
Comment 2 Daniel Veillard 2005-09-04 17:51:08 UTC
Okay, fixed, this should be commited to CVS shortly,

  thanks !

Daniel
Comment 3 Daniel Veillard 2005-09-05 08:59:41 UTC
This should be closed by release of libxml2-2.6.21,

  thanks,

Daniel