From 0ed5aee00074547ed58c55bef6d346a9a4dd4925 Mon Sep 17 00:00:00 2001
From: naruse <naruse@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Mon, 6 Sep 2010 00:46:48 +0000
Subject: [PATCH] * util.c (ruby_strtod): check integr overflow.  
 [ruby-dev:42180] #3789

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@29186 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 ChangeLog               |  5 +++++
 test/ruby/test_float.rb |  1 +
 util.c                  | 17 +++++++++++------
 3 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index c6bc385925..76f3dfdb9d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Mon Sep  6 09:44:50 2010  NARUSE, Yui  <naruse@ruby-lang.org>
+
+	* util.c (ruby_strtod): check integr overflow.
+	  [ruby-dev:42180] #3789
+
 Mon Sep  6 06:17:21 2010  Tanaka Akira  <akr@fsij.org>
 
 	* ext/pathname/pathname.c (path_readable_p): Pathname#readable?
diff --git a/test/ruby/test_float.rb b/test/ruby/test_float.rb
index e534ab294f..08ec63a6f9 100644
--- a/test/ruby/test_float.rb
+++ b/test/ruby/test_float.rb
@@ -448,6 +448,7 @@ class TestFloat < Test::Unit::TestCase
     assert_raise(ArgumentError) { Float("1.0\x001") }
     assert_equal(15.9375, Float('0xf.fp0'))
     assert_raise(ArgumentError) { Float('0xf.fp') }
+    assert_equal(Float::INFINITY, Float('0xf.fp1000000000000000'))
     assert_equal(1, suppress_warning {Float("1e10_00")}.infinite?)
     assert_raise(TypeError) { Float(nil) }
     o = Object.new
diff --git a/util.c b/util.c
index 762d97f0b9..9d10498a66 100644
--- a/util.c
+++ b/util.c
@@ -2143,12 +2143,17 @@ break2:
 
                nd = 0;
                c = *s;
-               if (c < '0' || '9' < c) goto ret0;
-               do {
-		    nd *= 10;
-		    nd += c;
-		    nd -= '0';
-                   c = *++s;
+	       if (c < '0' || '9' < c) goto ret0;
+	       do {
+		   nd *= 10;
+		   nd += c;
+		   nd -= '0';
+		   c = *++s;
+		   /* Float("0x0."+("0"*267)+"1fp2095") */
+		   if (abs(nd) > 2095) {
+		       while ('0' <= c && c <= '9') c = *++s;
+		       break;
+		   }
                } while ('0' <= c && c <= '9');
 		dval(rv) = ldexp(adj, nd * dsign);
 	    }