From fcd6b5ac36a49e83e27e9186ded04329d3b0b0d9 Mon Sep 17 00:00:00 2001
From: Joseph Myers <joseph@codesourcery.com>
Date: Wed, 13 Jun 2018 16:06:14 +0000
Subject: Fix strtod overflow detection (bug 23279).

As shown by bug 23279, strtod's round_and_return has an off-by-one
error in its overflow detection, only counting an exponent greater
than MAX_EXP as overflowing when an exponent of MAX_EXP also means
overflow (recall the ISO C definition of DBL_MAX_EXP etc. is based on
a floating-point model where 2^exp is multiplied by a value in the
interval [0.5, 1), so 2^MAX_EXP is not representable).

For decimal arguments to strtod, a separate overflow check in the main
implementation covers the case where the integer part of the argument
(truncated to the nearest integer towards zero) has more than MAX_EXP
bits, meaning that this issue in round_and_return only affects cases
(arguments with absolute value strictly between the maximum
representable value and 2^MAX_EXP) where overflow depends on the
rounding mode; in such cases, the returned value would still have been
correct on overflow but without the overflow exception being raised or
errno being set to ERANGE.  For hex float arguments, however, other
cases can arise, as shown in bug 23279, where a value with exponent
already set to MAX_EXP is passed into round_and_return and a result
can wrongly end up being NaN, or infinity instead of the largest
finite value.

This patch fixes the off-by-one error, adds testing of overflow
exceptions to the tst-strtod-round framework, and adds tests of these
issues.

Tested for x86_64.  Also ran the tst-strtod-round tests for powerpc to
make sure the new tests didn't introduce any new failures for IBM long
double.

	[BZ #23279]
	* stdlib/strtod_l.c (round_and_return): Handle an exponent of
	MAX_EXP as overflowing.
	* stdlib/gen-tst-strtod-round.c (string_to_fp): Clear MPFR
	overflow flag.
	(round_str): Output also whether result overflows in each rounding
	mode.
	* stdlib/tst-strtod-round-data: Add more tests.
	* stdlib/tst-strtod-round-data.h: Regenerated.
	* stdlib/tst-strtod-round-skeleton.c (_XNTRY): Update comment.
	(TEST): Handle extra arguments for overflow flags.
	(struct test_overflow): New type.
	[!FE_OVERFLOW] (FE_OVERFLOW): Define to 0.
	(GEN_ONE_TEST): Clear all exceptions.  Test overflow flag.
	(test_in_one_mode): Take argument with overflow information.
	(do_test): Update calls to test_in_one_mode.
---
 stdlib/gen-tst-strtod-round.c | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

(limited to 'stdlib/gen-tst-strtod-round.c')

diff --git a/stdlib/gen-tst-strtod-round.c b/stdlib/gen-tst-strtod-round.c
index a8f1c60f55..df9dcaf2fe 100644
--- a/stdlib/gen-tst-strtod-round.c
+++ b/stdlib/gen-tst-strtod-round.c
@@ -45,6 +45,7 @@
 static int
 string_to_fp (mpfr_t f, const char *s, mpfr_rnd_t rnd)
 {
+  mpfr_clear_overflow ();
 #ifdef WORKAROUND
   mpfr_t f2;
   mpfr_init2 (f2, 100000);
@@ -73,34 +74,45 @@ static void
 round_str (FILE *fout, const char *s, int prec, int emin, int emax,
 	   bool ibm_ld)
 {
+  mpfr_t max_value;
   mpfr_t f;
   mpfr_set_default_prec (prec);
   mpfr_set_emin (emin);
   mpfr_set_emax (emax);
   mpfr_init (f);
   int r = string_to_fp (f, s, MPFR_RNDD);
+  bool overflow = mpfr_overflow_p () != 0;
   if (ibm_ld)
     {
       assert (prec == 106 && emin == -1073 && emax == 1024);
       /* The maximum value in IBM long double has discontiguous
 	 mantissa bits.  */
-      mpfr_t max_value;
       mpfr_init2 (max_value, 107);
       mpfr_set_str (max_value, "0x1.fffffffffffff7ffffffffffffcp+1023", 0,
 		    MPFR_RNDN);
       if (mpfr_cmpabs (f, max_value) > 0)
-	r = 1;
-      mpfr_clear (max_value);
+	{
+	  r = 1;
+	  overflow = true;
+	}
     }
   mpfr_fprintf (fout, "\t%s,\n", r ? "false" : "true");
-  print_fp (fout, f, ",\n");
+  print_fp (fout, f, overflow ? ", true,\n" : ", false,\n");
   string_to_fp (f, s, MPFR_RNDN);
-  print_fp (fout, f, ",\n");
+  overflow = (mpfr_overflow_p () != 0
+	      || (ibm_ld && mpfr_cmpabs (f, max_value) > 0));
+  print_fp (fout, f, overflow ? ", true,\n" : ", false,\n");
   string_to_fp (f, s, MPFR_RNDZ);
-  print_fp (fout, f, ",\n");
+  overflow = (mpfr_overflow_p () != 0
+	      || (ibm_ld && mpfr_cmpabs (f, max_value) > 0));
+  print_fp (fout, f, overflow ? ", true,\n" : ", false,\n");
   string_to_fp (f, s, MPFR_RNDU);
-  print_fp (fout, f, "");
+  overflow = (mpfr_overflow_p () != 0
+	      || (ibm_ld && mpfr_cmpabs (f, max_value) > 0));
+  print_fp (fout, f, overflow ? ", true" : ", false");
   mpfr_clear (f);
+  if (ibm_ld)
+    mpfr_clear (max_value);
 }
 
 static void
-- 
cgit 1.4.1