From patchwork Fri Jun 25 14:33:48 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Schwab X-Patchwork-Id: 44027 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 48B1839540F4 for ; Fri, 25 Jun 2021 21:39:01 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail-out.m-online.net (mail-out.m-online.net [IPv6:2001:a60:0:28:0:1:25:1]) by sourceware.org (Postfix) with ESMTPS id BD70138930C7 for ; Fri, 25 Jun 2021 21:38:48 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org BD70138930C7 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=linux-m68k.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=nefkom.net Received: from frontend01.mail.m-online.net (unknown [192.168.8.182]) by mail-out.m-online.net (Postfix) with ESMTP id 4GBVkH3gL7z1s31m for ; Fri, 25 Jun 2021 23:38:47 +0200 (CEST) Received: from localhost (dynscan1.mnet-online.de [192.168.6.70]) by mail.m-online.net (Postfix) with ESMTP id 4GBVkH3XY5z1qqkk for ; Fri, 25 Jun 2021 23:38:47 +0200 (CEST) X-Virus-Scanned: amavisd-new at mnet-online.de Received: from mail.mnet-online.de ([192.168.8.182]) by localhost (dynscan1.mail.m-online.net [192.168.6.70]) (amavisd-new, port 10024) with ESMTP id xJp7lVG__Zc4 for ; Fri, 25 Jun 2021 23:38:46 +0200 (CEST) X-Auth-Info: Ep3vCqVMhQqQuL2bpPIJo5H0PJxcGC4WkUVMXi8xuThR8/QMFnNhuKGYWKeB+s0/ Received: from igel.home (ppp-46-244-182-31.dynamic.mnet-online.de [46.244.182.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.mnet-online.de (Postfix) with ESMTPSA for ; Fri, 25 Jun 2021 23:38:46 +0200 (CEST) Received: by igel.home (Postfix, from userid 1000) id 8630A2C3692; Fri, 25 Jun 2021 16:33:48 +0200 (CEST) From: Andreas Schwab To: libc-alpha@sourceware.org Subject: [PATCH] wordexp: handle overflow in positional parameter number (bug 28011) X-Yow: I appoint you ambassador to Fantasy Island!!! Date: Fri, 25 Jun 2021 16:33:48 +0200 Message-ID: <87pmwaypwz.fsf@igel.home> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 X-Spam-Status: No, score=-9.1 required=5.0 tests=BAYES_00, DATE_IN_PAST_06_12, GIT_PATCH_0, HEADER_FROM_DIFFERENT_DOMAINS, KAM_DMARC_STATUS, RCVD_IN_DNSWL_LOW, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces+patchwork=sourceware.org@sourceware.org Sender: "Libc-alpha" Use strtoul instead of atoi so that overflow can be detected. --- posix/wordexp-test.c | 1 + posix/wordexp.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/posix/wordexp-test.c b/posix/wordexp-test.c index f93a546d7e..9df02dbbb3 100644 --- a/posix/wordexp-test.c +++ b/posix/wordexp-test.c @@ -183,6 +183,7 @@ struct test_case_struct { 0, NULL, "$var", 0, 0, { NULL, }, IFS }, { 0, NULL, "\"\\n\"", 0, 1, { "\\n", }, IFS }, { 0, NULL, "", 0, 0, { NULL, }, IFS }, + { 0, NULL, "${1234567890123456789012}", 0, 0, { NULL, }, IFS }, /* Flags not already covered (testit() has special handling for these) */ { 0, NULL, "one two", WRDE_DOOFFS, 2, { "one", "two", }, IFS }, diff --git a/posix/wordexp.c b/posix/wordexp.c index bcbe96e48d..1f3b09f721 100644 --- a/posix/wordexp.c +++ b/posix/wordexp.c @@ -1399,7 +1399,7 @@ envsubst: /* Is it a numeric parameter? */ else if (isdigit (env[0])) { - int n = atoi (env); + unsigned long n = strtoul (env, NULL, 10); if (n >= __libc_argc) /* Substitute NULL. */