Piotr Caban : msvcrt: Avoid depending on signed variable overflow in parse_double.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 65642f4bb7d9c8bfb9f16f6f59d4c06271431f43
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=65642f4bb7d9c8bfb9f16f6f5...

Author: Piotr Caban <piotr(a)codeweavers.com>
Date:   Fri May  1 11:58:11 2020 +0200

msvcrt: Avoid depending on signed variable overflow in parse_double.

Signed-off-by: Piotr Caban <piotr(a)codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard(a)winehq.org>

---

 dlls/msvcrt/string.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/dlls/msvcrt/string.c b/dlls/msvcrt/string.c
index b2bc3e9c2e..31ed4e2181 100644
--- a/dlls/msvcrt/string.c
+++ b/dlls/msvcrt/string.c
@@ -549,8 +549,10 @@ static double strtod16(MSVCRT_wchar_t get(void *ctx), void unget(void *ctx),
         }
         if(nch>='0' && nch<='9') {
             while(nch>='0' && nch<='9') {
-                if(e>INT_MAX/10 || (e=e*10+nch-'0')<0)
+                if(e>INT_MAX/10 || e*10>INT_MAX-nch+'0')
                     e = INT_MAX;
+                else
+                    e = e*10+nch-'0';
                 nch = get(ctx);
             }
             if((nch!=MSVCRT_WEOF) && (nch < '0' || nch > '9')) unget(ctx);
@@ -827,8 +829,10 @@ double parse_double(MSVCRT_wchar_t (*get)(void *ctx), void (*unget)(void *ctx),
 
         if(nch>='0' && nch<='9') {
             while(nch>='0' && nch<='9') {
-                if(e>INT_MAX/10 || (e=e*10+nch-'0')<0)
+                if(e>INT_MAX/10 || e*10>INT_MAX-nch+'0')
                     e = INT_MAX;
+                else
+                    e = e*10+nch-'0';
                 nch = get(ctx);
             }
             if(nch != MSVCRT_WEOF) unget(ctx);