Merge pull request from GHSA-7hmr-442f-qc8j

The unit allocated for decNumberCompare was accidentally removed by
commit 680baeffeb7983e7570b5e68db07fe47f94db8c7 (PR #2804)

This caused a stack overflow when comparing a nan with a payload of 1000
or more.

This bug was found by OSS-fuzz.
Ref: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64771
Fixes GHSA-7hmr-442f-qc8j

It also fixes 1e999999999 > 1e-1147483646   triggering UBSAN errors
Fixes #2968

1 files changed, 8 insertions, 4 deletions

diff --git a/src/jv.c b/src/jv.c
index 4031dc62..6ca1e1d0 100644
--- a/src/jv.c
+++ b/src/jv.c
@@ -740,15 +740,19 @@ int jvp_number_cmp(jv a, jv b) {
 
 #ifdef USE_DECNUM
   if (JVP_HAS_FLAGS(a, JVP_FLAGS_NUMBER_LITERAL) && JVP_HAS_FLAGS(b, JVP_FLAGS_NUMBER_LITERAL)) {
-    decNumber res;
-    decNumberCompare(&res,
+    struct {
+      decNumber number;
+      decNumberUnit units[1];
+    } res;
+
+    decNumberCompare(&res.number,
                      jvp_dec_number_ptr(a),
                      jvp_dec_number_ptr(b),
                      DEC_CONTEXT()
                      );
-    if (decNumberIsZero(&res)) {
+    if (decNumberIsZero(&res.number)) {
       return 0;
-    } else if (decNumberIsNegative(&res)) {
+    } else if (decNumberIsNegative(&res.number)) {
       return -1;
     } else {
       return 1;