840720 - Check for the finiteness of the values returned from the ToDouble calls in the nsHTMLInputElement code

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jonathan Watt [:jwatt]]

It seems that nsTString_CharT::ToDouble can return +/-Infinity while returning NS_OK via the out-param. (See bug 836314 comment 15.) We should check the value returned from the ToDouble calls in ConvertStringToNumber and convert them to NaN if they are not finite so that ConvertStringToNumber's callers handle bad user input correctly.

Comment 1

[Mounir Lamouri (:mounir)]

I guess the best behaviour would be to do something like:
- parse the value to double;
- check if the value is finite;
- if it is not, return false (all callers correctly check that the method return true).

Comment 2

[Jonathan Watt [:jwatt]]

Attachment: patch

Comment 3

[Jonathan Watt [:jwatt]]

Attachment: patch + comments requested in bug 838256 comment 13

Comment 4

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Comment on attachment 713140 [details] [diff] [review]
patch + comments requested in bug 838256 comment 13

Review of attachment 713140 [details] [diff] [review]:
-----------------------------------------------------------------

::: content/html/content/src/nsHTMLInputElement.h
@@ +674,5 @@
>    /**
>     * Returns the input's "maximum" (as defined by the HTML5 spec) as a double.
>     * Note this takes account of any default maximum that the type may have.
>     * Returns NaN if the max attribute isn't a valid floating point number and
> +   * the input's type does not have a default maximum. Otherwise, guaranteed 

trailing whitespace

Comment 5

[Jonathan Watt [:jwatt]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ca6fb08cb6a2

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ca6fb08cb6a2