Commit message: Fix 698920: Guard jsdtoa from integer overflow wreaking havoc.
CVE: CVE-2018-6191
CWE: CWE-190
Vulnerability description: The js_strtod function in jsdtoa.c in Artifex MuJS through 1.0.2 has an integer overflow because of incorrect exponent validation.

Project: mujs
File: jsdtoa.c

static diy_fp_t multiply(diy_fp_t x, diy_fp_t y)
{
	uint64_t a,b,c,d,ac,bc,ad,bd,tmp;
	diy_fp_t r;
	uint64_t M32 = 0xFFFFFFFF;
	a = x.f >> 32; b = x.f & M32;
	c = y.f >> 32; d = y.f & M32;
	ac = a*c; bc = b*c; ad = a*d; bd = b*d;
	tmp = (bd>>32) + (ad&M32) + (bc&M32);
	tmp += 1U << 31;
	r.f = ac+(ad>>32)+(bc>>32)+(tmp >>32);
	r.e = x.e + y.e + 64;
	return r;
}

Project: mujs
File: jsdtoa.c

static void normalized_boundaries(double d, diy_fp_t* out_m_minus, diy_fp_t* out_m_plus)
{
	diy_fp_t v = double2diy_fp(d);
	diy_fp_t pl, mi;
	int significand_is_zero = v.f == DP_HIDDEN_BIT;
	pl.f = (v.f << 1) + 1; pl.e = v.e - 1;
	pl = normalize_boundary(pl);
	if (significand_is_zero) {
		mi.f = (v.f << 2) - 1;
		mi.e = v.e - 2;
	} else {
		mi.f = (v.f << 1) - 1;
		mi.e = v.e - 1;
	}
	mi.f <<= mi.e - pl.e;
	mi.e = pl.e;
	*out_m_plus = pl;
	*out_m_minus = mi;
}

Project: mujs
File: jsdtoa.c

static uint64_t double_to_uint64(double d)
{
	union { double d; uint64_t n; } tmp;
	tmp.d = d;
	return tmp.n;
}

Project: mujs
File: jsdtoa.c

static void digit_gen(diy_fp_t Mp, diy_fp_t delta, char* buffer, int* len, int* K)
{
	uint32_t div, p1;
	uint64_t p2;
	int d,kappa;
	diy_fp_t one;
	one.f = ((uint64_t) 1) << -Mp.e; one.e = Mp.e;
	p1 = Mp.f >> -one.e;
	p2 = Mp.f & (one.f - 1);
	*len = 0; kappa = 3; div = TEN2;
	while (kappa > 0) {
		d = p1 / div;
		if (d || *len) buffer[(*len)++] = '0' + d;
		p1 %= div; kappa--; div /= 10;
		if ((((uint64_t)p1)<<-one.e)+p2 <= delta.f) {
			*K += kappa; return;
		}
	}
	do {
		p2 *= 10;
		d = p2 >> -one.e;
		if (d || *len) buffer[(*len)++] = '0' + d;
		p2 &= one.f - 1; kappa--; delta.f *= 10;
	} while (p2 > delta.f);
	*K += kappa;
}

Project: mujs
File: jsdtoa.c

static diy_fp_t cached_power(int k)
{
	diy_fp_t res;
	int index = 343 + k;
	res.f = powers_ten[index];
	res.e = powers_ten_e[index];
	return res;
}

Project: mujs
File: jsdtoa.c

static diy_fp_t minus(diy_fp_t x, diy_fp_t y)
{
	diy_fp_t r;
	assert(x.e == y.e);
	assert(x.f >= y.f);
	r.f = x.f - y.f;
	r.e = x.e;
	return r;
}

Project: mujs
File: jsdtoa.c

js_grisu2(double v, char *buffer, int *K)
{
	int length, mk;
	diy_fp_t w_m, w_p, c_mk, Wp, Wm, delta;
	int q = 64, alpha = -59, gamma = -56;
	normalized_boundaries(v, &w_m, &w_p);
	mk = k_comp(w_p.e + q, alpha, gamma);
	c_mk = cached_power(mk);
	Wp = multiply(w_p, c_mk);
	Wm = multiply(w_m, c_mk);
	Wm.f++; Wp.f--;
	delta = minus(Wp, Wm);
	*K = -mk;
	digit_gen(Wp, delta, buffer, &length, K);
	return length;
}

Project: mujs
File: jsdtoa.c

js_fmtexp(char *p, int e)
{
	char se[9];
	int i;

	*p++ = 'e';
	if(e < 0) {
		*p++ = '-';
		e = -e;
	} else
		*p++ = '+';
	i = 0;
	while(e) {
		se[i++] = e % 10 + '0';
		e /= 10;
	}
	while(i < 1)
		se[i++] = '0';
	while(i > 0)
		*p++ = se[--i];
	*p++ = '\0';
}

Project: mujs
File: jsdtoa.c

static diy_fp_t normalize_boundary(diy_fp_t in)
{
	diy_fp_t res = in;
	/* Normalize now */
	/* the original number could have been a denormal. */
	while (! (res.f & (DP_HIDDEN_BIT << 1))) {
		res.f <<= 1;
		res.e--;
	}
	/* do the final shifts in one go. Don't forget the hidden bit (the '-1') */
	res.f <<= (DIY_SIGNIFICAND_SIZE - DP_SIGNIFICAND_SIZE - 2);
	res.e = res.e - (DIY_SIGNIFICAND_SIZE - DP_SIGNIFICAND_SIZE - 2);
	return res;
}

Project: mujs
File: jsdtoa.c

js_strtod(const char *string, char **endPtr)
{
	int sign, expSign = FALSE;
	double fraction, dblExp, *d;
	register const char *p;
	register int c;

	/* Exponent read from "EX" field. */
	int exp = 0;

	/* Exponent that derives from the fractional part. Under normal
	 * circumstances, it is the negative of the number of digits in F.
	 * However, if I is very long, the last digits of I get dropped
	 * (otherwise a long I with a large negative exponent could cause an
	 * unnecessary overflow on I alone). In this case, fracExp is
	 * incremented one for each dropped digit.
	 */
	int fracExp = 0;

	/* Number of digits in mantissa. */
	int mantSize;

	/* Number of mantissa digits BEFORE decimal point. */
	int decPt;

	/* Temporarily holds location of exponent in string. */
	const char *pExp;

	/*
	 * Strip off leading blanks and check for a sign.
	 */

	p = string;
	while (*p == ' ' || *p == '\t' || *p == '\n' || *p == '\r') {
		p += 1;
	}
	if (*p == '-') {
		sign = TRUE;
		p += 1;
	} else {
		if (*p == '+') {
			p += 1;
		}
		sign = FALSE;
	}

	/*
	 * Count the number of digits in the mantissa (including the decimal
	 * point), and also locate the decimal point.
	 */

	decPt = -1;
	for (mantSize = 0; ; mantSize += 1)
	{
		c = *p;
		if (!(c>='0'&&c<='9')) {
			if ((c != '.') || (decPt >= 0)) {
				break;
			}
			decPt = mantSize;
		}
		p += 1;
	}

	/*
	 * Now suck up the digits in the mantissa. Use two integers to
	 * collect 9 digits each (this is faster than using floating-point).
	 * If the mantissa has more than 18 digits, ignore the extras, since
	 * they can't affect the value anyway.
	 */

	pExp = p;
	p -= mantSize;
	if (decPt < 0) {
		decPt = mantSize;
	} else {
		mantSize -= 1;			/* One of the digits was the point. */
	}
	if (mantSize > 18) {
		fracExp = decPt - 18;
		mantSize = 18;
	} else {
		fracExp = decPt - mantSize;
	}
	if (mantSize == 0) {
		fraction = 0.0;
		p = string;
		goto done;
	} else {
		int frac1, frac2;
		frac1 = 0;
		for ( ; mantSize > 9; mantSize -= 1)
		{
			c = *p;
			p += 1;
			if (c == '.') {
				c = *p;
				p += 1;
			}
			frac1 = 10*frac1 + (c - '0');
		}
		frac2 = 0;
		for (; mantSize > 0; mantSize -= 1)
		{
			c = *p;
			p += 1;
			if (c == '.') {
				c = *p;
				p += 1;
			}
			frac2 = 10*frac2 + (c - '0');
		}
		fraction = (1.0e9 * frac1) + frac2;
	}

	/*
	 * Skim off the exponent.
	 */

	p = pExp;
	if ((*p == 'E') || (*p == 'e')) {
		p += 1;
		if (*p == '-') {
			expSign = TRUE;
			p += 1;
		} else {
			if (*p == '+') {
				p += 1;
			}
			expSign = FALSE;
		}
		while ((*p >= '0') && (*p <= '9')) {
			exp = exp * 10 + (*p - '0');
			p += 1;
		}
	}
	if (expSign) {
		exp = fracExp - exp;
	} else {
		exp = fracExp + exp;
	}

	/*
	 * Generate a floating-point number that represents the exponent.
	 * Do this by processing the exponent one bit at a time to combine
	 * many powers of 2 of 10. Then combine the exponent with the
	 * fraction.
	 */

	if (exp < -maxExponent) {
		exp = maxExponent;
		expSign = TRUE;
		errno = ERANGE;
	} else if (exp > maxExponent) {
		exp = maxExponent;
		expSign = FALSE;
		errno = ERANGE;
	} else if (exp < 0) {
		expSign = TRUE;
		exp = -exp;
	} else {
		expSign = FALSE;
	}
	dblExp = 1.0;
	for (d = powersOf10; exp != 0; exp >>= 1, d += 1) {
		if (exp & 01) {
			dblExp *= *d;
		}
	}
	if (expSign) {
		fraction /= dblExp;
	} else {
		fraction *= dblExp;
	}

done:
	if (endPtr != NULL) {
		*endPtr = (char *) p;
	}

	if (sign) {
		return -fraction;
	}
	return fraction;
}

Project: mujs
File: jsdtoa.c

static diy_fp_t double2diy_fp(double d)
{
	uint64_t d64 = double_to_uint64(d);
	int biased_e = (d64 & DP_EXPONENT_MASK) >> DP_SIGNIFICAND_SIZE;
	uint64_t significand = (d64 & DP_SIGNIFICAND_MASK);
	diy_fp_t res;
	if (biased_e != 0) {
		res.f = significand + DP_HIDDEN_BIT;
		res.e = biased_e - DP_EXPONENT_BIAS;
	} else {
		res.f = significand;
		res.e = DP_MIN_EXPONENT + 1;
	}
	return res;
}

Project: mujs
File: jsdtoa.c

static int k_comp(int e, int alpha, int gamma) {
	return ceil((alpha-e+63) * D_1_LOG2_10);
}