Piotr Caban : jscript: Fix integer/double parsing.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 063df731ac7b1795786ec447b5b325a043fc44d7
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=063df731ac7b1795786ec447b5b325a043fc44d7

Author: Piotr Caban <piotr.caban at gmail.com>
Date:   Wed May 27 01:10:49 2009 +0200

jscript: Fix integer/double parsing.

---

 dlls/jscript/lex.c         |   26 ++++++++++++++++++++------
 dlls/jscript/tests/lang.js |    2 ++
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/dlls/jscript/lex.c b/dlls/jscript/lex.c
index 68bfef8..c066397 100644
--- a/dlls/jscript/lex.c
+++ b/dlls/jscript/lex.c
@@ -17,6 +17,7 @@
  */
 
 #include <math.h>
+#include <limits.h>
 
 #include "jscript.h"
 #include "activscp.h"
@@ -374,13 +375,19 @@ static int parse_double_literal(parser_ctx_t *ctx, LONG int_part, literal_t **li
 {
     double d, tmp = 1.0;
 
-    if(ctx->ptr == ctx->end || !isdigitW(*ctx->ptr)) {
-        ERR("No digit after point\n");
+    if(ctx->ptr == ctx->end || (!isdigitW(*ctx->ptr) &&
+        *ctx->ptr!='.' && *ctx->ptr!='e' && *ctx->ptr!='E')) {
+        ERR("Illegal character\n");
         return 0;
     }
 
     d = int_part;
     while(ctx->ptr < ctx->end && isdigitW(*ctx->ptr))
+        d = d*10 + *(ctx->ptr++) - '0';
+
+    if(*ctx->ptr == '.') ctx->ptr++;
+
+    while(ctx->ptr < ctx->end && isdigitW(*ctx->ptr))
         d += (tmp /= 10.0)*(*ctx->ptr++ - '0');
 
     if(ctx->ptr < ctx->end && (*ctx->ptr == 'e' || *ctx->ptr == 'E')) {
@@ -458,13 +465,20 @@ static int parse_numeric_literal(parser_ctx_t *ctx, literal_t **literal)
     }
 
     while(ctx->ptr < ctx->end && isdigitW(*ctx->ptr))
-        l = l*10 + *(ctx->ptr++)-'0';
+    {
+        d = l*10 + *(ctx->ptr)-'0';
+
+        /* Check for integer overflow */
+        if (l > INT_MAX/10 || d < 0)
+            return parse_double_literal(ctx, l, literal);
+
+        l = d;
+        ctx->ptr++;
+    }
 
     if(ctx->ptr < ctx->end) {
-        if(*ctx->ptr == '.') {
-            ctx->ptr++;
+        if(*ctx->ptr == '.' || *ctx->ptr == 'e' || *ctx->ptr == 'E')
             return parse_double_literal(ctx, l, literal);
-        }
 
         if(is_identifier_char(*ctx->ptr)) {
             WARN("unexpected identifier char\n");
diff --git a/dlls/jscript/tests/lang.js b/dlls/jscript/tests/lang.js
index 0d68f37..c4f0194 100644
--- a/dlls/jscript/tests/lang.js
+++ b/dlls/jscript/tests/lang.js
@@ -33,6 +33,8 @@ ok(true === true, "true === true is false");
 ok(null === null, "null === null is false");
 ok(undefined === undefined, "undefined === undefined is false");
 ok(!(undefined === null), "!(undefined === null) is false");
+ok(1E0 === 1, "1E0 === 1 is false");
+ok(1000000*1000000 === 1000000000000, "1000000*1000000 === 1000000000000 is false");
 
 ok(1 !== 2, "1 !== 2 is false");
 ok(null !== undefined, "null !== undefined is false");