From 93d13ad2acc6a52d58e09d84e76826cd36ee64f0 Mon Sep 17 00:00:00 2001
From: Milo Yip <miloyip@gmail.com>
Date: Fri, 24 Apr 2015 21:44:42 +0800
Subject: [PATCH] Fix #313 Assertion In `Pow10.h` is triggered in
 Document::Parse

---
 include/rapidjson/reader.h   |  5 +++++
 test/unittest/readertest.cpp | 14 +++++++++-----
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/include/rapidjson/reader.h b/include/rapidjson/reader.h
index 08297a0..320428f 100644
--- a/include/rapidjson/reader.h
+++ b/include/rapidjson/reader.h
@@ -929,6 +929,11 @@ private:
                     exp = exp * 10 + (s.Take() - '0');
                     if (exp > 308 && !expMinus) // exp > 308 should be rare, so it should be checked first.
                         RAPIDJSON_PARSE_ERROR(kParseErrorNumberTooBig, s.Tell());
+                    else if (exp >= 429496729 && expMinus) {        // Issue #313: prevent overflow exponent
+                        while (s.Peek() >= '0' && s.Peek() <= '9')  // Consume the rest of exponent
+                            s.Take();
+                        break;
+                    }
                 }
             }
             else
diff --git a/test/unittest/readertest.cpp b/test/unittest/readertest.cpp
index 4e8d4e4..86199fa 100644
--- a/test/unittest/readertest.cpp
+++ b/test/unittest/readertest.cpp
@@ -219,13 +219,17 @@ static void TestParseDouble() {
     TEST_DOUBLE(fullPrecision, "2.2250738585072009e-308", 2.2250738585072009e-308); // Max subnormal double
     TEST_DOUBLE(fullPrecision, "2.2250738585072014e-308", 2.2250738585072014e-308); // Min normal positive double
     TEST_DOUBLE(fullPrecision, "1.7976931348623157e+308", 1.7976931348623157e+308); // Max double
-    TEST_DOUBLE(fullPrecision, "1e-10000", 0.0);                                   // must underflow
-    TEST_DOUBLE(fullPrecision, "18446744073709551616", 18446744073709551616.0);    // 2^64 (max of uint64_t + 1, force to use double)
-    TEST_DOUBLE(fullPrecision, "-9223372036854775809", -9223372036854775809.0);    // -2^63 - 1(min of int64_t + 1, force to use double)
-    TEST_DOUBLE(fullPrecision, "0.9868011474609375", 0.9868011474609375);          // https://github.com/miloyip/rapidjson/issues/120
-    TEST_DOUBLE(fullPrecision, "123e34", 123e34);                                  // Fast Path Cases In Disguise
+    TEST_DOUBLE(fullPrecision, "1e-10000", 0.0);                                    // must underflow
+    TEST_DOUBLE(fullPrecision, "18446744073709551616", 18446744073709551616.0);     // 2^64 (max of uint64_t + 1, force to use double)
+    TEST_DOUBLE(fullPrecision, "-9223372036854775809", -9223372036854775809.0);     // -2^63 - 1(min of int64_t + 1, force to use double)
+    TEST_DOUBLE(fullPrecision, "0.9868011474609375", 0.9868011474609375);           // https://github.com/miloyip/rapidjson/issues/120
+    TEST_DOUBLE(fullPrecision, "123e34", 123e34);                                   // Fast Path Cases In Disguise
     TEST_DOUBLE(fullPrecision, "45913141877270640000.0", 45913141877270640000.0);
     TEST_DOUBLE(fullPrecision, "2.2250738585072011e-308", 2.2250738585072011e-308); // http://www.exploringbinary.com/php-hangs-on-numeric-value-2-2250738585072011e-308/
+    TEST_DOUBLE(fullPrecision, "1e-00011111111111", 0.0);                           // Issue #313
+    TEST_DOUBLE(fullPrecision, "-1e-00011111111111", -0.0);
+    TEST_DOUBLE(fullPrecision, "1e-429496729", 0.0);                                // Maximum supported negative exponent
+    
 
     // Since
     // abs((2^-1022 - 2^-1074) - 2.2250738585072012e-308) = 3.109754131239141401123495768877590405345064751974375599... กม 10^-324