1 files changed, 18 insertions, 7 deletions

diff --git a/src/3rdparty/double-conversion/double-conversion.cc b/src/3rdparty/double-conversion/double-conversion.cc
index 881ca0adbc..8c52755cfb 100644
--- a/src/3rdparty/double-conversion/double-conversion.cc
+++ b/src/3rdparty/double-conversion/double-conversion.cc
@@ -255,6 +255,12 @@ bool DoubleToStringConverter::ToExponential(
   const int kDecimalRepCapacity = kMaxExponentialDigits + 2;
   ASSERT(kDecimalRepCapacity > kBase10MaximalLength);
   char decimal_rep[kDecimalRepCapacity];
+#ifndef NDEBUG
+  // Problem: there is an assert in StringBuilder::AddSubstring() that
+  // will pass this buffer to strlen(), and this buffer is not generally
+  // null-terminated.
+  memset(decimal_rep, 0, sizeof(decimal_rep));
+#endif
   int decimal_rep_length;
 
   if (requested_digits == -1) {
@@ -534,7 +540,7 @@ static double SignedZero(bool sign) {
 // because it constant-propagated the radix and concluded that the last
 // condition was always true. By moving it into a separate function the
 // compiler wouldn't warn anymore.
-#if _MSC_VER
+#ifdef _MSC_VER
 #pragma optimize("",off)
 static bool IsDecimalDigitForRadix(int c, int radix) {
   return '0' <= c && c <= '9' && (c - '0') < radix;
@@ -558,7 +564,7 @@ static bool IsCharacterDigitForRadix(int c, int radix, char a_character) {
 
 // Returns true, when the iterator is equal to end.
 template<class Iterator>
-static bool Advance (Iterator* it, char separator, int base, Iterator& end) {
+static bool Advance (Iterator* it, uc16 separator, int base, Iterator& end) {
   if (separator == StringToDoubleConverter::kNoSeparator) {
     ++(*it);
     return *it == end;
@@ -586,7 +592,7 @@ static bool Advance (Iterator* it, char separator, int base, Iterator& end) {
 template<class Iterator>
 static bool IsHexFloatString(Iterator start,
                              Iterator end,
-                             char separator,
+                             uc16 separator,
                              bool allow_trailing_junk) {
   ASSERT(start != end);
 
@@ -603,8 +609,8 @@ static bool IsHexFloatString(Iterator start,
       saw_digit = true;
       if (Advance(&current, separator, 16, end)) return false;
     }
-    if (!saw_digit) return false;  // Only the '.', but no digits.
   }
+  if (!saw_digit) return false;
   if (*current != 'p' && *current != 'P') return false;
   if (Advance(&current, separator, 16, end)) return false;
   if (*current == '+' || *current == '-') {
@@ -627,7 +633,7 @@ template <int radix_log_2, class Iterator>
 static double RadixStringToIeee(Iterator* current,
                                 Iterator end,
                                 bool sign,
-                                char separator,
+                                uc16 separator,
                                 bool parse_as_hex_float,
                                 bool allow_trailing_junk,
                                 double junk_string_value,
@@ -762,7 +768,11 @@ static double RadixStringToIeee(Iterator* current,
     }
     int written_exponent = 0;
     while (IsDecimalDigitForRadix(**current, 10)) {
-      written_exponent = 10 * written_exponent + **current - '0';
+      // No need to read exponents if they are too big. That could potentially overflow
+      // the `written_exponent` variable.
+      if (abs(written_exponent) <= 100 * Double::kMaxExponent) {
+        written_exponent = 10 * written_exponent + **current - '0';
+      }
       if (Advance(current, separator, radix, end)) break;
     }
     if (is_negative) written_exponent = -written_exponent;
@@ -898,10 +908,11 @@ double StringToDoubleConverter::StringToIeee(
         (*current == 'x' || *current == 'X')) {
       ++current;
 
+      if (current == end) return junk_string_value_;  // "0x"
+
       bool parse_as_hex_float = (flags_ & ALLOW_HEX_FLOATS) &&
                 IsHexFloatString(current, end, separator_, allow_trailing_junk);
 
-      if (current == end) return junk_string_value_;  // "0x"
       if (!parse_as_hex_float && !isDigit(*current, 16)) {
         return junk_string_value_;
       }