Commit 40503428 authored by Nick Wellnhofer's avatar Nick Wellnhofer

Lower bound for format token "a"

Handle xsl:number with format "a" and value 0 according to XSLT 2.0.

Fixes an OOB array access in xsltNumberFormatAlpha.
parent 69ec3da1
...@@ -227,7 +227,8 @@ xsltNumberFormatDecimal(xmlBufferPtr buffer, ...@@ -227,7 +227,8 @@ xsltNumberFormatDecimal(xmlBufferPtr buffer,
} }
static void static void
xsltNumberFormatAlpha(xmlBufferPtr buffer, xsltNumberFormatAlpha(xsltNumberDataPtr data,
xmlBufferPtr buffer,
double number, double number,
int is_upper) int is_upper)
{ {
...@@ -237,6 +238,26 @@ xsltNumberFormatAlpha(xmlBufferPtr buffer, ...@@ -237,6 +238,26 @@ xsltNumberFormatAlpha(xmlBufferPtr buffer,
char *alpha_list; char *alpha_list;
double alpha_size = (double)(sizeof(alpha_upper_list) - 1); double alpha_size = (double)(sizeof(alpha_upper_list) - 1);
/*
* XSLT 1.0 isn't clear on how to handle zero, but XSLT 2.0 says:
*
* For all format tokens other than the first kind above (one that
* consists of decimal digits), there may be implementation-defined
* lower and upper bounds on the range of numbers that can be
* formatted using this format token; indeed, for some numbering
* sequences there may be intrinsic limits. [...] Numbers that fall
* outside this range must be formatted using the format token 1.
*
* The "a" token has an intrinsic lower limit of 1.
*/
if (number < 1.0) {
xsltNumberFormatDecimal(buffer, number, '0', 1,
data->digitsPerGroup,
data->groupingCharacter,
data->groupingCharacterLen);
return;
}
/* Build buffer from back */ /* Build buffer from back */
pointer = &temp_string[sizeof(temp_string)]; pointer = &temp_string[sizeof(temp_string)];
*(--pointer) = 0; *(--pointer) = 0;
...@@ -500,16 +521,10 @@ xsltNumberFormatInsertNumbers(xsltNumberDataPtr data, ...@@ -500,16 +521,10 @@ xsltNumberFormatInsertNumbers(xsltNumberDataPtr data,
switch (token->token) { switch (token->token) {
case 'A': case 'A':
xsltNumberFormatAlpha(buffer, xsltNumberFormatAlpha(data, buffer, number, TRUE);
number,
TRUE);
break; break;
case 'a': case 'a':
xsltNumberFormatAlpha(buffer, xsltNumberFormatAlpha(data, buffer, number, FALSE);
number,
FALSE);
break; break;
case 'I': case 'I':
xsltNumberFormatRoman(buffer, xsltNumberFormatRoman(buffer,
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment