From 45fb06753f183299e7ccf63b750e551615426d8c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?D=C3=A1niel=20B=C3=A1tyai?= Date: Mon, 22 Jun 2015 15:22:49 +0200 Subject: [PATCH] Fix buffer size in Number.prototype.toFixed() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit JerryScript-DCO-1.0-Signed-off-by: Dániel Bátyai dbatyai.u-szeged@partner.samsung.com --- .../builtin-objects/ecma-builtin-number-prototype.cpp | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/jerry-core/ecma/builtin-objects/ecma-builtin-number-prototype.cpp b/jerry-core/ecma/builtin-objects/ecma-builtin-number-prototype.cpp index fe75481ec5..ef66f08319 100644 --- a/jerry-core/ecma/builtin-objects/ecma-builtin-number-prototype.cpp +++ b/jerry-core/ecma/builtin-objects/ecma-builtin-number-prototype.cpp @@ -268,7 +268,13 @@ ecma_builtin_number_prototype_object_to_fixed (ecma_value_t this_arg, /**< this else { /* Buffer that is used to construct the string. */ - int buffer_size = (exponent > 0) ? exponent + frac_digits + 1 : frac_digits + 2; + int buffer_size = (exponent > 0) ? exponent + frac_digits + 2 : frac_digits + 3; + + if (is_negative) + { + buffer_size++; + } + JERRY_ASSERT (buffer_size > 0); MEM_DEFINE_LOCAL_ARRAY (buff, buffer_size, ecma_char_t); @@ -360,6 +366,7 @@ ecma_builtin_number_prototype_object_to_fixed (ecma_value_t this_arg, /**< this } } + JERRY_ASSERT (p - buff < buffer_size); /* String terminator. */ *p = 0; ecma_string_t* str = ecma_new_ecma_string ((ecma_char_t *) buff);