diff options
| author |  David G. Andersen <dga@google.com> | 2016-10-20 18:25:04 -0800 |
|---|---|---|
| committer |  TensorFlower Gardener <gardener@tensorflow.org> | 2016-10-20 19:38:28 -0700 |
| commit | 7231d01fcb2cd9ef9ffbfea03b724892c8a4026e (patch) | |
| tree | 4db9d5770fcb03f1342dcd4d36e2623debf2a6ce /tensorflow/core/lib/strings/numbers.cc | |
| parent | 7b4af07b7424d76d460ea1afc999532f77ee8386 (diff) | |
Fix out-of-bounds read discovered by libFuzzer.
locale_independent_strtonum returned str-1 incorrectly if there was
overflow, because s.fail() was set, which causes s.tellg() to return -1.
Change: 136790139
Diffstat (limited to 'tensorflow/core/lib/strings/numbers.cc')
| -rw-r--r-- | tensorflow/core/lib/strings/numbers.cc | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/tensorflow/core/lib/strings/numbers.cc b/tensorflow/core/lib/strings/numbers.cc index 797233e746..4df0f54378 100644 --- a/tensorflow/core/lib/strings/numbers.cc +++ b/tensorflow/core/lib/strings/numbers.cc @@ -86,9 +86,11 @@ T locale_independent_strtonum(const char* str, const char** endptr) { if (result == std::numeric_limits<T>::max()) { result = std::numeric_limits<T>::infinity(); real_fail = false; + s.clear(s.rdstate() & ~std::ios::failbit); } else if (result == -std::numeric_limits<T>::max()) { result = -std::numeric_limits<T>::infinity(); real_fail = false; + s.clear(s.rdstate() & ~std::ios::failbit); } } |