tree fe7a1f7b4580426266209f6047adb4e9736cd06c
parent c9a51565214eece8f1053089739aea73145bfd6b
author Emanuele Torre <torreemanuele6@gmail.com> 1702495222 +0100
committer GitHub <noreply@github.com> 1702495222 +0100
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJlegP2CRBK7hj4Ov3rIwAA7NIIADbb9dS0IRHbXaJ0g1Hrw7qO
 UHE/UqXB/UAqPZV02rsy6chEfUoZuzfNzXfNa/a2R+s2BUXulCD7nkYVKSvzbh0y
 tzhcIBGhhPYNh9rOzTIbc3u5kLFnJm/zb1F9p2/dP8lNya2nPxt6OzHZrUis1khV
 uCHIROCjVfTrQjJrI/Yp+IjarPA12Pyc+e7nZAIXAaWkr4g1drWuJxHxd1lJ54d+
 S+PHfbP3y49EhBiwP60CWGGL/Za+SMAl33VCQsfb/1rD3iSxW/fLcJUPjku3+uV8
 6lKgNcks47eBrQFtVvVT02EU79uiw63yIAFGTqQNjFxV9FY3kCYg7WweJ9rq9Z4=
 =+8fB
 -----END PGP SIGNATURE-----
 

Merge pull request from GHSA-686w-5m7m-54vc

decNumberToString calls for a buffer that can hold a string of digits+14
characters, not a buffer of size digits+14.
We need to allocate an extra byte for the NUL byte.

-10E-1000010001, for example, will be stringified as -1.0E-1000010000
and decNumberToString will currently write an extra NUL byte after the
allocated buffer in the heap.

Originally reported by @SEU-SSL on GitHub.

Ref: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574

Fixes GHSA-686w-5m7m-54vc