Attachment 988 Details for Bug 1506 – use strtoul instead of strtol in various places to fix potential overflows

[patch] use strtoul instead of strtol in various places to fix potential overflows

update-mime-db.diff (text/plain), 2.19 KB, created by Christophe Fergeau on 2004-10-01 04:13:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Christophe Fergeau

Created: 2004-10-01 04:13:22 UTC

Size: 2.19 KB

patch

obsolete

>? update-mime-db.diff
>Index: update-mime-database.c
>===================================================================
>RCS file: /cvs/mime/shared-mime-info/update-mime-database.c,v
>retrieving revision 1.30
>diff -u -r1.30 update-mime-database.c
>--- update-mime-database.c	13 Oct 2003 09:43:38 -0000	1.30
>+++ update-mime-database.c	1 Oct 2004 10:54:29 -0000
>@@ -73,8 +73,8 @@
> };
> 
> struct _Match {
>-	long range_start;
>-	int range_length;
>+	guint64 range_start;
>+	guint64 range_length;
> 	char word_size;
> 	int data_length;
> 	char *data;
>@@ -809,7 +809,14 @@
> 	unsigned long value;
> 	int b;
> 
>-	value = strtol(in, &end, 0);
>+	value = strtoul(in, &end, 0);
>+	if (errno == ERANGE) {
>+		g_set_error(error, MIME_ERROR, 0,
>+			    "Number out-of-range (%s should fit in %d bytes)",
>+			    in, bytes);
>+		return;
>+	}
>+
> 	if (*end != '\0')
> 	{
> 		g_set_error(error, MIME_ERROR, 0, "Value is not a number");
>@@ -834,9 +841,17 @@
> 	if (in_mask)
> 	{
> 		int b;
>-		long mask;
>+		unsigned long mask;
> 		
>-		mask = strtol(in_mask, &end, 0);
>+		mask = strtoul(in_mask, &end, 0);
>+		if (errno == ERANGE) {
>+			g_set_error(error, MIME_ERROR, 0,
>+				    "Mask out-of-range (%s should fit in %d bytes)",
>+				    in_mask, bytes);
>+			return;
>+		}
>+
>+
> 		if (*end != '\0')
> 		{
> 			g_set_error(error, MIME_ERROR, 0,
>@@ -990,12 +1005,34 @@
> 		goto err;
> 	}
> 
>-	match->range_start = strtol(offset, &end, 10);
>+	match->range_start = g_ascii_strtoull(offset, &end, 10);
>+	if (errno == ERANGE) {
>+		char *number;
>+		number = g_strndup(offset, end-offset);
>+		g_set_error(error, MIME_ERROR, 0,
>+			    "Number out-of-range (%s should fit in 8  bytes)",
>+			    number);
>+		g_free(number);
>+		return;
>+	}
>+
> 	if (*end == ':' && end[1] && match->range_start >= 0)
> 	{
>-		int last;
>+		guint64 last;
>+		char *begin;
>+
>+		begin = end + 1;
>+		last = g_ascii_strtoull(begin, &end, 10);
>+		if (errno == ERANGE) {
>+			char *number;
>+			number = g_strndup(begin, end-begin);
>+			g_set_error(error, MIME_ERROR, 0,
>+				    "Number out-of-range (%s should fit in 8  bytes)",
>+				    number);
>+			g_free(number);
>+			return;
>+		}
> 
>-		last = strtol(end + 1, &end, 10);
> 		if (*end == '\0' && last >= match->range_start)
> 			match->range_length = last - match->range_start + 1;
> 		else

Actions: View | Splinter Review

Attachments on bug 1506: 988 | 1404

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.