Merge pull request #314 from miloyip/issue313_exponentoverflow

Fix #313 Assertion In `Pow10.h` is triggered in Document::Parse

include/rapidjson/reader.h

@@ -925,12 +925,24 @@ private:
 
             if (s.Peek() >= '0' && s.Peek() <= '9') {
                 exp = s.Take() - '0';
+                if (expMinus) {
                     while (s.Peek() >= '0' && s.Peek() <= '9') {
                         exp = exp * 10 + (s.Take() - '0');
-                    if (exp > 308 && !expMinus) // exp > 308 should be rare, so it should be checked first.
+                        if (exp >= 214748364) {                         // Issue #313: prevent overflow exponent
+                            while (s.Peek() >= '0' && s.Peek() <= '9')  // Consume the rest of exponent
+                                s.Take();
+                        }
+                    }
+                }
+                else {  // positive exp
+                    int maxExp = 308 - expFrac;
+                    while (s.Peek() >= '0' && s.Peek() <= '9') {
+                        exp = exp * 10 + (s.Take() - '0');
+                        if (exp > maxExp)
                             RAPIDJSON_PARSE_ERROR(kParseErrorNumberTooBig, s.Tell());
                     }
                 }
+            }
             else
                 RAPIDJSON_PARSE_ERROR(kParseErrorNumberMissExponent, s.Tell());
 

test/unittest/readertest.cpp

@@ -226,6 +226,12 @@ static void TestParseDouble() {
     TEST_DOUBLE(fullPrecision, "123e34", 123e34);                                   // Fast Path Cases In Disguise
     TEST_DOUBLE(fullPrecision, "45913141877270640000.0", 45913141877270640000.0);
     TEST_DOUBLE(fullPrecision, "2.2250738585072011e-308", 2.2250738585072011e-308); // http://www.exploringbinary.com/php-hangs-on-numeric-value-2-2250738585072011e-308/
+    TEST_DOUBLE(fullPrecision, "1e-00011111111111", 0.0);                           // Issue #313
+    TEST_DOUBLE(fullPrecision, "-1e-00011111111111", -0.0);
+    TEST_DOUBLE(fullPrecision, "1e-214748363", 0.0);                                  // Maximum supported negative exponent
+    TEST_DOUBLE(fullPrecision, "1e-214748364", 0.0);
+    TEST_DOUBLE(fullPrecision, "1e-21474836311", 0.0);
+    TEST_DOUBLE(fullPrecision, "0.017976931348623157e+310", 1.7976931348623157e+308); // Max double in another form
 
     // Since
     // abs((2^-1022 - 2^-1074) - 2.2250738585072012e-308) = 3.109754131239141401123495768877590405345064751974375599...  10^-324