diff options
author | roberto <roberto@FreeBSD.org> | 2008-08-22 15:58:00 +0000 |
---|---|---|
committer | roberto <roberto@FreeBSD.org> | 2008-08-22 15:58:00 +0000 |
commit | b85c7169a740b2edf0106ad59fdaa1b0160f823c (patch) | |
tree | 2b9fb7f64eacb322e95695e412c923e97ba33e88 /contrib/ntp/libntp/dolfptoa.c | |
parent | 1d197cfe9feac6bc29537d8e53c30b6435937b95 (diff) | |
parent | 7a6072eb585696f8856cd498c3fd194cf49f14c6 (diff) | |
download | FreeBSD-src-b85c7169a740b2edf0106ad59fdaa1b0160f823c.zip FreeBSD-src-b85c7169a740b2edf0106ad59fdaa1b0160f823c.tar.gz |
Merge ntpd & friends 4.2.4p5 from vendor/ntp/dist into head. Next commit
will update usr.sbin/ntp to match this.
MFC after: 2 weeks
Diffstat (limited to 'contrib/ntp/libntp/dolfptoa.c')
-rw-r--r-- | contrib/ntp/libntp/dolfptoa.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/contrib/ntp/libntp/dolfptoa.c b/contrib/ntp/libntp/dolfptoa.c index 7c92a30..f68679c 100644 --- a/contrib/ntp/libntp/dolfptoa.c +++ b/contrib/ntp/libntp/dolfptoa.c @@ -36,6 +36,14 @@ dolfptoa( memset((char *) cbuf, 0, sizeof(cbuf)); /* + * safeguard against sign extensions and other mishaps on 64 bit platforms + * the code following is designed for and only for 32-bit inputs and + * only 32-bit worth of input are supplied. + */ + fpi &= 0xffffffff; + fpv &= 0xffffffff; + + /* * Work on the integral part. This is biased by what I know * compiles fairly well for a 68000. */ @@ -49,6 +57,7 @@ dolfptoa( ltmp = lwork; lwork /= lten; ltmp -= (lwork << 3) + (lwork << 1); + if (cp < cbuf) abort(); /* rather die a horrible death than trash the memory */ *--cp = (u_char)ltmp; } while (lwork & 0xffff0000); } @@ -61,6 +70,7 @@ dolfptoa( stmp = swork; swork = (u_short) (swork/sten); stmp = (u_short)(stmp - ((swork<<3) + (swork<<1))); + if (cp < cbuf) abort(); /* rather die a horrible death than trash the memory */ *--cp = (u_char)stmp; } while (swork != 0); } @@ -110,6 +120,7 @@ dolfptoa( *cpend++ = (u_char)work.l_ui; if (work.l_uf == 0) break; + if (cpend > (cbuf + sizeof(cbuf))) abort(); /* rather die a horrible death than trash the memory */ } /* |