Page MenuHome GnuPG

Missing case distinction for value "NaN" and "Inf" of IEEE floating point variable in function print_number(...) in the file cJSON.c:176
Closed, ResolvedPublic

Description

(SYSTEM: ArchLinux - current version, gpgme version 1.12.0)
In print_number of cJSON.c is not able to print "NaN" or "inf", if this values are in a cJSON-object. “NaN” or “inf” are possible states of IEEE 754 floating point representation.

FIX:

static char * print_number (cJSON * item){
...
 Else {
    str = xtrymalloc (64);  /* This is a nice tradeoff. */
    if (str){
    if (fabs (floor (d) - d) <= DBL_EPSILON && fabs (d) < 1.0e60)
      sprintf (str, "%.0f", d);
    else if (fabs (d) < 1.0e-6 || fabs (d) > 1.0e9)
      sprintf (str, "%e", d);
+    else if( isnan(n) || isinf(n) )  {
+      sprintf (str, "%s", “nan or inf”);
+    }
    else
      sprintf (str, "%f", d);
  }

found with libFuzzer and ASAN by clang 7.0.1

regards
Sirko Höer
Code Intelligence GmbH

Details

Version
1.12.0

Revisions and Commits

Event Timeline

aheinecke triaged this task as Normal priority.
aheinecke added a subscriber: aheinecke.

Thanks, I don't think that it is a problem for our usecase but the fix is trivial and we should apply it.

werner added a subscriber: werner.

Fixed similar to the suggestion but NaN and INF are detected earlier.