From 5c74651e19a7e119b3f4325fba389f3b0afb4015 Mon Sep 17 00:00:00 2001
From: Ramya Eliger <ramya@digiscrypt.com>
Date: Wed, 19 Aug 2026 12:10:20 +0530
Subject: [PATCH] guard zero digit count in GenerateCountedDigits

---
 double-conversion/bignum-dtoa.cc |  5 +++++
 test/cctest/test-bignum-dtoa.cc  | 20 ++++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/double-conversion/bignum-dtoa.cc b/double-conversion/bignum-dtoa.cc
index 15123e6a..1d44b875 100644
--- a/double-conversion/bignum-dtoa.cc
+++ b/double-conversion/bignum-dtoa.cc
@@ -284,6 +284,11 @@ static void GenerateCountedDigits(int count, int* decimal_point,
                                   Bignum* numerator, Bignum* denominator,
                                   Vector<char> buffer, int* length) {
   DOUBLE_CONVERSION_ASSERT(count >= 0);
+  if (count == 0) {
+    // No digits requested. The "last digit" store below would write buffer[-1].
+    *length = 0;
+    return;
+  }
   for (int i = 0; i < count - 1; ++i) {
     uint16_t digit;
     digit = numerator->DivideModuloIntBignum(*denominator);
diff --git a/test/cctest/test-bignum-dtoa.cc b/test/cctest/test-bignum-dtoa.cc
index 670e5c48..cd57f814 100644
--- a/test/cctest/test-bignum-dtoa.cc
+++ b/test/cctest/test-bignum-dtoa.cc
@@ -258,6 +258,26 @@ TEST(BignumDtoaVariousDoubles) {
 }
 
 
+TEST(BignumDtoaZeroPrecision) {
+  // Requesting zero precision digits must produce an empty representation
+  // without storing the "last digit" at buffer[-1]. A sentinel byte sits
+  // immediately before the output buffer to catch that store.
+  char container[kBufferSize];
+  container[0] = '@';
+  Vector<char> buffer(container + 1, kBufferSize - 1);
+  int length;
+  int point;
+
+  BignumDtoa(1.0, BIGNUM_DTOA_PRECISION, 0, buffer, &length, &point);
+  CHECK_EQ(0, length);
+  CHECK(container[0] == '@');
+
+  BignumDtoa(123.456, BIGNUM_DTOA_PRECISION, 0, buffer, &length, &point);
+  CHECK_EQ(0, length);
+  CHECK(container[0] == '@');
+}
+
+
 TEST(BignumDtoaShortestVariousFloats) {
   char buffer_container[kBufferSize];
   Vector<char> buffer(buffer_container, kBufferSize);