6 files changed, 18 insertions, 0 deletions
diff --git a/sysdeps/ieee754/dbl-64/s_getpayload.c b/sysdeps/ieee754/dbl-64/s_getpayload.c
index 3ab89ddd66..5a055be35a 100644
--- a/sysdeps/ieee754/dbl-64/s_getpayload.c
+++ b/sysdeps/ieee754/dbl-64/s_getpayload.c
@@ -27,6 +27,9 @@ __getpayload (const double *x)
 {
   uint32_t hx, lx;
   EXTRACT_WORDS (hx, lx, *x);
+  if ((hx & 0x7ff00000) != 0x7ff00000
+      || ((hx & 0xfffff) | lx) == 0)
+    return -1;
   hx &= 0x7ffff;
   uint64_t ix = ((uint64_t) hx << 32) | lx;
   if (FIX_INT_FP_CONVERT_ZERO && ix == 0)
diff --git a/sysdeps/ieee754/dbl-64/wordsize-64/s_getpayload.c b/sysdeps/ieee754/dbl-64/wordsize-64/s_getpayload.c
index 2c887b93b7..eba96d0c77 100644
--- a/sysdeps/ieee754/dbl-64/wordsize-64/s_getpayload.c
+++ b/sysdeps/ieee754/dbl-64/wordsize-64/s_getpayload.c
@@ -26,6 +26,9 @@ __getpayload (const double *x)
 {
   uint64_t ix;
   EXTRACT_WORDS64 (ix, *x);
+  if ((ix & 0x7ff0000000000000ULL) != 0x7ff0000000000000ULL
+      || (ix & 0xfffffffffffffULL) == 0)
+    return -1;
   ix &= 0x7ffffffffffffULL;
   return (double) ix;
 }
diff --git a/sysdeps/ieee754/flt-32/s_getpayloadf.c b/sysdeps/ieee754/flt-32/s_getpayloadf.c
index e1d22473ff..1baad4847e 100644
--- a/sysdeps/ieee754/flt-32/s_getpayloadf.c
+++ b/sysdeps/ieee754/flt-32/s_getpayloadf.c
@@ -27,6 +27,9 @@ __getpayloadf (const float *x)
 {
   uint32_t ix;
   GET_FLOAT_WORD (ix, *x);
+  if ((ix & 0x7f800000) != 0x7f800000
+      || (ix & 0x7fffff) == 0)
+    return -1;
   ix &= 0x3fffff;
   if (FIX_INT_FP_CONVERT_ZERO && ix == 0)
     return 0.0f;
diff --git a/sysdeps/ieee754/ldbl-128/s_getpayloadl.c b/sysdeps/ieee754/ldbl-128/s_getpayloadl.c
index db55a00f66..1fbe704608 100644
--- a/sysdeps/ieee754/ldbl-128/s_getpayloadl.c
+++ b/sysdeps/ieee754/ldbl-128/s_getpayloadl.c
@@ -26,6 +26,9 @@ __getpayloadl (const _Float128 *x)
 {
   uint64_t hx, lx;
   GET_LDOUBLE_WORDS64 (hx, lx, *x);
+  if ((hx & 0x7fff000000000000ULL) != 0x7fff000000000000ULL
+      || ((hx & 0xffffffffffffULL) | lx) == 0)
+    return -1;
   hx &= 0x7fffffffffffULL;
   /* Construct the representation of the return value directly, since
      128-bit integers may not be available.  */
diff --git a/sysdeps/ieee754/ldbl-128ibm/s_getpayloadl.c b/sysdeps/ieee754/ldbl-128ibm/s_getpayloadl.c
index 3b5a1a8414..abbd694eea 100644
--- a/sysdeps/ieee754/ldbl-128ibm/s_getpayloadl.c
+++ b/sysdeps/ieee754/ldbl-128ibm/s_getpayloadl.c
@@ -27,6 +27,9 @@ __getpayloadl (const long double *x)
   double xhi = ldbl_high (*x);
   uint64_t ix;
   EXTRACT_WORDS64 (ix, xhi);
+  if ((ix & 0x7ff0000000000000ULL) != 0x7ff0000000000000ULL
+      || (ix & 0xfffffffffffffULL) == 0)
+    return -1;
   ix &= 0x7ffffffffffffULL;
   if (FIX_INT_FP_CONVERT_ZERO && ix == 0)
     return 0.0L;
diff --git a/sysdeps/ieee754/ldbl-96/s_getpayloadl.c b/sysdeps/ieee754/ldbl-96/s_getpayloadl.c
index 8f09cb74c8..761bd69b58 100644
--- a/sysdeps/ieee754/ldbl-96/s_getpayloadl.c
+++ b/sysdeps/ieee754/ldbl-96/s_getpayloadl.c
@@ -27,6 +27,9 @@ __getpayloadl (const long double *x)
   uint16_t se __attribute__ ((unused));
   uint32_t hx, lx;
   GET_LDOUBLE_WORDS (se, hx, lx, *x);
+  if ((se & 0x7fff) != 0x7fff
+      || ((hx & 0x7fffffff) | lx) == 0)
+    return -1;
   hx &= 0x3fffffff;
   uint64_t ix = ((uint64_t) hx << 32) | lx;
   return (long double) ix;