From d53f7f64f7920dac7def57cd3dacf44efc784369 Mon Sep 17 00:00:00 2001 From: Jilles Tjoelker Date: Sun, 17 Aug 2014 16:40:29 +0000 Subject: [PATCH] sh: Reject integer overflow in number and is_number. --- bin/sh/mystring.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/bin/sh/mystring.c b/bin/sh/mystring.c index 03ea8bac608..19de78d9fd5 100644 --- a/bin/sh/mystring.c +++ b/bin/sh/mystring.c @@ -82,9 +82,17 @@ number(const char *s) int is_number(const char *p) { - do { - if (! is_digit(*p)) + const char *q; + + if (*p == '\0') + return 0; + while (*p == '0') + p++; + for (q = p; *q != '\0'; q++) + if (! is_digit(*q)) return 0; - } while (*++p != '\0'); + if (q - p > 10 || + (q - p == 10 && memcmp(p, "2147483647", 10) > 0)) + return 0; return 1; }