Skip to content

fix: out-of-bounds write in decimal Display implementation

Denis Smirnov requested to merge issue71 into master

fixes #71 (closed) (more details in the comment).

Previously we used ds->digits+14 buffer capacity to display a decimal with decNumberToString() function, while Tarantool uses DECIMAL_MAX_DIGITS + 14 length. As a result we have faced malloc header corruption in its free block list caused by an out of bounds write to buffer (other possible result could be a memory segfault).

Edited by Denis Smirnov

Merge request reports