Date: Fri, 26 Jul 2013 12:17:11 +0400 From: Sergey Kandaurov <pluknet@gmail.com> To: FreeBSD Current <freebsd-current@freebsd.org> Subject: [patch] expand_number(3): check strtoumax(3) for ERANGE Message-ID: <CAE-mSOKZL1iKiExaAsQ=%2Bz7ioOyz=6tKtOUid6K20G2OeeGo0w@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
Hi,
As of now expand_number(3) does not properly check too large data.
It currently handles errors only for prefixed values.
(an argument is intentionally signed to be closer to the real buggish world,
e.g. as it's currently done in truncate(1). This should not compile, though
see bsd.sys.mk@169723).
int64_t sz;
if (expand_number(argv[1], &sz) < 0)
err(1, "expand_number");
printf("%ld\n", sz);
[pluknet@omg] ./expand_number 8000p
9007199254740992000
[pluknet@omg] ./expand_number 9000p
-8313644912125935616
[pluknet@omg] ./expand_number 19000p
expand_number: expand_number: Result too large
[pluknet@omg] ./expand_number 0x7fffffffffffffff (INT64_MAX)
9223372036854775807
[pluknet@omg] ./expand_number 0xffffffffffffffff (UINT64_MAX)
-1
But
[pluknet@omg] ./expand_number 0xfffffffffffffffff (> UINT64_MAX)
-1 (actually UINTMAX_MAX expressed as signed)
This is how it should work:
[pluknet@omg] ./expand_number 0xfffffffffffffffff (> UINT64_MAX)
expand_number: expand_number: Result too large
Index: lib/libutil/expand_number.c
===================================================================
--- lib/libutil/expand_number.c (revision 253546)
+++ lib/libutil/expand_number.c (working copy)
@@ -55,6 +55,10 @@
number = strtoumax(buf, &endptr, 0);
+ if (number == UINTMAX_MAX && errno == ERANGE) {
+ return (-1);
+ }
+
if (endptr == buf) {
/* No valid digits. */
errno = EINVAL;
--
wbr,
pluknet
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAE-mSOKZL1iKiExaAsQ=%2Bz7ioOyz=6tKtOUid6K20G2OeeGo0w>