From b609df78b5b1e40a6160393d060d8d38e4ad908a Mon Sep 17 00:00:00 2001 From: Andrea Mazzoleni Date: Mon, 24 May 2021 19:43:53 +0200 Subject: [PATCH] Add overflow checking on the interger parsing --- cmdline/stream.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/cmdline/stream.c b/cmdline/stream.c index f28338fa..72a6a4e3 100644 --- a/cmdline/stream.c +++ b/cmdline/stream.c @@ -501,15 +501,34 @@ int sgetu32(STREAM* f, uint32_t* value) int c; c = sgetc(f); - if (c >= '0' && c <= '9') { + if (c == '0') { + *value = 0; + return 0; + } else if (c >= '1' && c <= '9') { uint32_t v; v = c - '0'; c = sgetc(f); while (c >= '0' && c <= '9') { + uint32_t digit; + if (v > 0xFFFFFFFFU / 10) { + /* LCOV_EXCL_START */ + /* overflow */ + return -1; + /* LCOV_EXCL_STOP */ + } v *= 10; - v += c - '0'; + + digit = c - '0'; + if (v > 0xFFFFFFFFU - digit) { + /* LCOV_EXCL_START */ + /* overflow */ + return -1; + /* LCOV_EXCL_STOP */ + } + v += digit; + c = sgetc(f); }