News for hackers. Stuff that matters.

A comment on Heap Overflow in Floating Point Parsing (CVE-2013-4164). Parent comment

Re:Heap Overflow in Floating Point Parsing (CVE-2013-4164) by c3 on Friday November 22, 2013 @03:50AM (#6779822)
update: I just tested this; if you're on 1.8.7, you can manually apply the patch I linked in the parent comment and recompile. There is nothing preventing a backport.
[ Parent | on HN ]
Re:Heap Overflow in Floating Point Parsing (CVE-2013-4164) by darkhelmetlive on Friday November 22, 2013 @12:40PM (#6782303)
There's also a commit right after the merge commit to change

  if (nf > DBL_DIG * 2) continue;
to

  if (nf > DBL_DIG * 4) continue;
[ Parent | on HN ]