Merge pull request #1270 from donc/regression8639realmax

8639 dmd buffer overflow related to function literal, real.max template alias parameter

src/expression.c

@@ -2498,8 +2498,11 @@ void floatToBuffer(OutBuffer *buf, Type *type, real_t value)
      * to decimal then back again. If it matches, use it.
      * If it doesn't, fall back to hex, which is
      * always exact.
+     * Longest string is for -real.max:
+     * "-1.18973e+4932\0".length == 17
+     * "-0xf.fffffffffffffffp+16380\0".length == 28
      */
-    char buffer[25];
+    char buffer[32];
     ld_sprint(buffer, 'g', value);
     assert(strlen(buffer) < sizeof(buffer));
 #if _WIN32 && __DMC__

test/compilable/compile1.d

@@ -147,6 +147,15 @@ static assert( !is(typeof( (){
       undefined ~= delegate(){}; return 7;
   }())));
 
+/**************************************************
+    8639  Buffer overflow
+**************************************************/
+
+void t8639(alias a)() {}
+void bug8639() {
+  t8639!({auto r = -real.max;})();
+}
+
 /**************************************************
     7751  Segfault
 **************************************************/