commit 9e91f71e071eee73620e288aa7eba0c2f8089bdc
Author: Jim Meyering <meyering(a)redhat.com>
Date: Wed Mar 23 18:54:42 2011 +0100
iwhd: reject a provider that's specified with an invalid port number
Before, due to our use of atoi, we would accept e.g., 2^32,
and treat it like 0. Similarly, 2^32+1 would be treated as 1.
* setup.c: Include "xstrtol.h".
(add_provider): Do not accept bogus port numbers.
Use xstrtol instead.
setup.c | 14 +++++++++++++-
1 files changed, 13 insertions(+), 1 deletions(-)
---
diff --git a/setup.c b/setup.c
index 5a9144e..5e32387 100644
--- a/setup.c
+++ b/setup.c
@@ -35,6 +35,7 @@
#include "query.h"
#include "meta.h"
#include "xalloc.h"
+#include "xstrtol.h"
/*
* A config consists of a JSON array of objects, where each object includes:
@@ -398,7 +399,18 @@ add_provider (Hash_table *h)
goto fail;
prov->host = kv_hash_lookup(h,"host");
- prov->port = atoi(kv_hash_lookup(h,"port"));
+
+ char *port_str = kv_hash_lookup (h, "port");
+ if (port_str == NULL)
+ goto fail;
+
+ long int port;
+ if ( ! (xstrtol (port_str, NULL, 10, &port, "") == LONGINT_OK
+ && 0 < port && port <= INT_MAX))
+ goto fail;
+
+ prov->port = port;
+
/* TBD: change key/secret field names to username/password */
prov->username = kv_hash_lookup(h,"key");
prov->password = kv_hash_lookup(h,"secret");
Show replies by date