mirror of
https://github.com/mruby/mruby
synced 2026-06-08 16:11:16 +00:00
403b75fbeb
mrb_read_float's underflow short-circuit used `final_p < -342 - nd`, which for nd > 1 can be below POW10_MIN (-343). That let parse_decimal call prescale() with a final_p below POW10_MIN, causing an out-of-bounds read of pow10_tab. Tighten the guard to `final_p < POW10_MIN`; values below that threshold cannot be represented as a non-zero double for any mantissa within the parser's 19-digit cap. Reported by OSS-Fuzz (testcase 6097379597287424). Co-authored-by: Claude <noreply@anthropic.com>