From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from picard.linux.it (picard.linux.it [213.254.12.146]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E77CFCA601E for ; Fri, 9 Oct 2026 11:59:14 +0000 (UTC) Received: from picard.linux.it (localhost [IPv6:::1]) by picard.linux.it (Postfix) with ESMTP id 055F73E6AE5 for ; Fri, 9 Oct 2026 13:59:13 +0200 (CEST) Received: from in-5.smtp.seeweb.it (in-5.smtp.seeweb.it [217.194.8.5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (No client certificate requested) by picard.linux.it (Postfix) with ESMTPS id 284903E2911 for ; Fri, 9 Oct 2026 13:58:57 +0200 (CEST) Received: from smtp-out2.suse.de (smtp-out2.suse.de [IPv6:2a07:de40:b251:101:10:150:64:2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by in-5.smtp.seeweb.it (Postfix) with ESMTPS id 68F05600BE9 for ; Fri, 9 Oct 2026 13:58:57 +0200 (CEST) Received: from imap1.dmz-prg2.suse.org (imap1.dmz-prg2.suse.org [IPv6:2a07:de40:b281:104:10:150:64:97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 34F5D1F790; Fri, 9 Oct 2026 11:58:56 +0000 (UTC) Authentication-Results: smtp-out2.suse.de; none Received: from imap1.dmz-prg2.suse.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id 044731368B; Fri, 9 Oct 2026 11:58:56 +0000 (UTC) Received: from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167]) by imap1.dmz-prg2.suse.org with ESMTPSA id qsqoNP/WyGrhfQAAD6G6ig (envelope-from ); Fri, 09 Oct 2026 11:58:56 +0000 Date: Fri, 9 Oct 2026 13:59:09 +0200 From: Cyril Hrubis To: Andrea Cervesato Message-ID: References: <20261005-fix_core_lib_deepseek-v1-0-fec334ce8e80@suse.com> <20261005-fix_core_lib_deepseek-v1-6-fec334ce8e80@suse.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20261005-fix_core_lib_deepseek-v1-6-fec334ce8e80@suse.com> X-Rspamd-Pre-Result: action=no action; module=Unknown lua; unknown reason X-Spamd-Bar: / X-Rspamd-Queue-Id: 34F5D1F790 X-Rspamd-Pre-Result: action=no action; module=Unknown lua; unknown reason X-Rspamd-Action: no action X-Rspamd-Server: rspamd1.dmz-prg2.suse.org X-Spamd-Result: default: False [0.00 / 50.00] X-Virus-Scanned: clamav-milter 1.0.9 at in-5.smtp.seeweb.it X-Virus-Status: Clean Subject: Re: [LTP] [PATCH 06/15] ujson: reader: Check for signed integer overflow X-BeenThere: ltp@lists.linux.it X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux Test Project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Linux Test Project Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ltp-bounces+ltp=archiver.kernel.org@lists.linux.it Sender: "ltp" Hi! > static int get_int(ujson_reader *buf, struct ujson_val *res) > { > - long val = 0; > + unsigned long val = 0; > int sign = 1; > > if (eatb(buf, '-')) { > @@ -325,17 +326,25 @@ static int get_int(ujson_reader *buf, struct ujson_val *res) > return 1; > } > > + unsigned long max = (sign < 0) ? (unsigned long)LONG_MAX + 1UL : (unsigned long)LONG_MAX; > + > while (is_digit(peekb(buf))) { > - val *= 10; > - val += getb(buf) - '0'; > - //TODO: overflow? > + unsigned int d = getb(buf) - '0'; > + > + if (val > (max - d) / 10) { > + ujson_err(buf, "Integer overflow"); > + return 1; > + } > + > + val = val * 10 + d; > } > > if (sign < 0) > - val = -val; > + res->val_int = (long)(0UL - val); This would be better res->val_int = -(long)val; And I do not like the code that much, but I think that we cannot do much better without having separate functions for possitive and negative numbers. -- Cyril Hrubis chrubis@suse.cz -- Mailing list info: https://lists.linux.it/listinfo/ltp