summaryrefslogtreecommitdiff
path: root/lib/libc/stdlib
diff options
context:
space:
mode:
authorchristos <christos@NetBSD.org>2008-03-18 18:16:08 +0000
committerchristos <christos@NetBSD.org>2008-03-18 18:16:08 +0000
commit00f5c7fe8d79cfe12e84f3ef35a2a9c5c9acff7e (patch)
tree1d0271e2818ba4e7a67f0fe5af44b30726b1846d /lib/libc/stdlib
parent4453aa15bd6882707942a4a9e93861e4688d1bab (diff)
Avoid integer overflow; reported by Maksymilian Arciemowicz.
Diffstat (limited to 'lib/libc/stdlib')
-rw-r--r--lib/libc/stdlib/strfmon.c11
1 files changed, 8 insertions, 3 deletions
diff --git a/lib/libc/stdlib/strfmon.c b/lib/libc/stdlib/strfmon.c
index cbac1e3b4dd..482265e0d88 100644
--- a/lib/libc/stdlib/strfmon.c
+++ b/lib/libc/stdlib/strfmon.c
@@ -1,4 +1,4 @@
-/* $NetBSD: strfmon.c,v 1.4 2006/03/19 01:50:49 christos Exp $ */
+/* $NetBSD: strfmon.c,v 1.5 2008/03/18 18:16:08 christos Exp $ */
/*-
* Copyright (c) 2001 Alexey Zelkin <phantom@FreeBSD.org>
@@ -32,7 +32,7 @@
#if 0
__FBSDID("$FreeBSD: src/lib/libc/stdlib/strfmon.c,v 1.14 2003/03/20 08:18:55 ache Exp $");
#else
-__RCSID("$NetBSD: strfmon.c,v 1.4 2006/03/19 01:50:49 christos Exp $");
+__RCSID("$NetBSD: strfmon.c,v 1.5 2008/03/18 18:16:08 christos Exp $");
#endif
#endif /* LIBC_SCCS and not lint */
@@ -75,10 +75,15 @@ __RCSID("$NetBSD: strfmon.c,v 1.4 2006/03/19 01:50:49 christos Exp $");
} while (/* CONSTCOND */ 0)
#define GET_NUMBER(VAR) do { \
- VAR = 0; \
+ int ovar; \
+ ovar = VAR = 0; \
while (isdigit((unsigned char)*fmt)) { \
VAR *= 10; \
VAR += *fmt - '0'; \
+ if (ovar > VAR) \
+ goto e2big_error; \
+ else \
+ ovar = VAR; \
fmt++; \
} \
} while (/* CONSTCOND */ 0)