[bug] very very slow in parsing specific numbers

[boofish]

the trigger input: 8891110122900e913013935755114

[boofish]

I conduct a rough analysis and find the root cause lies in the function mystrtod(), where the loop executes 1622094001 times, which should be avoided.

[wtarreau]

Just stumbled on that one as well. It has two problems:

• one directly inherited from the original mystrtod() function that was not really a problem there but which is one here, which is that the exponent is not bounded, so it just overflows. Since double cannot be smaller than 1e-324 in absolute value (denormals) and much larger than 1e+308, we can simply bound e to 325 to cover both directions.
• a second one which is that the author (very likely for portability purposes) decided to avoid pow() and implement an iterative multiply. But that one is not efficient at all and a shift+square would be much better.

For the first one, the following patch addresses it:

--- ./src/mjson.c.orig      2025-09-29 19:16:38.177229589 +0200
+++ ./src/mjson.c   2025-09-29 19:17:11.472579353 +0200
@@ -788,6 +788,8 @@
     if (*p == '-') p++, neg++;
     if (*p == '+') p++;
     while (is_digit(*p)) e = e * 10 + *p++ - '0';
+    if ((unsigned)e > 325)
+      e = 325;
     if (neg) e = -e;
 #if 0
     if (d == 2.2250738585072011 && e == -308) {

Now for some use cases, the 325 multiplies or divides can still be too much, so doing it this way is better:

--- ./src/mjson.c.fix1
+++ ./src/mjson.c
@@ -767,7 +767,7 @@ static double mystrtod(const char *str, char **end) {
 
   /* exponential part */
   if ((*p == 'E') || (*p == 'e')) {
-    int i, e = 0, neg = 0;
+    int e = 0, neg = 0;
     p++;
     if (*p == '-') p++, neg++;
     if (*p == '+') p++;
@@ -785,8 +785,8 @@ static double mystrtod(const char *str, char **end) {
       goto done;
     }
 #endif
-    for (i = 0; i < e; i++) d *= 10;
-    for (i = 0; i < -e; i++) d /= 10;
+    if (e)
+           d *= pow(10.0, (double) e);
     a = p;
   } else if (p > str && !is_digit(*(p - 1))) {
     a = str;

If pow() is not available (embedded system), then doing it by hand is easy since e is an integer:

--- ./src/mjson.c.fix1
+++ ./src/mjson.c
@@ -767,13 +767,15 @@ static double mystrtod(const char *str, char **end) {
 
   /* exponential part */
   if ((*p == 'E') || (*p == 'e')) {
+    double exp, f;
     int i, e = 0, neg = 0;
     p++;
     if (*p == '-') p++, neg++;
     if (*p == '+') p++;
     while (is_digit(*p)) e = e * 10 + *p++ - '0';
     if ((unsigned)e > 325)
            e = 325;
+    i = e;
     if (neg) e = -e;
 #if 0
     if (d == 2.2250738585072011 && e == -308) {
@@ -785,8 +789,19 @@ static double mystrtod(const char *str, char **end) {
       goto done;
     }
 #endif
-    for (i = 0; i < e; i++) d *= 10;
-    for (i = 0; i < -e; i++) d /= 10;
+    /* calculate f = 10^i */
+    exp = 10;
+    f = 1;
+    while (i > 0) {
+      if (i & 1)
+        f *= exp;
+      exp = exp * exp;
+      i >>= 1;
+    }
+    if (e > 0)
+      d *= f;
+    else if (e < 0)
+      d /= f;
     a = p;
   } else if (p > str && !is_digit(*(p - 1))) {
     a = str;

Regardless of the fix(es), this should definitely be addressed. I hope someone can merge it.