[PATCH] simple_strtoul: prevent integer overflows

Mansour Moufid
2011-05-05T05:55:04Z

From: Mansour Moufid <mansourmoufid@gmail.com>

This patch prevents integer overflows in the functions
`simple_strtoull' and `simple_strtoul', in the file lib/vsprintf.c.
This applies to stable version 2.6.38.5.

I'm aware of the kstrto* functions, but simple_strto* are still used
in some network-exposed code (netfilter).

Signed-off-by: Mansour Moufid <mansourmoufid@gmail.com>
---
--- vsprintf.c.orig 2011-05-04 22:00:07.000000000 -0400
+++ vsprintf.c 2011-05-04 22:27:45.000000000 -0400
@@ -63,11 +63,20 @@ unsigned long long simple_strtoull(const
cp += 2;

while (isxdigit(*cp)) {
- unsigned int value;
+ unsigned int value = 0;

- value = isdigit(*cp) ? *cp - '0' : TOLOWER(*cp) - 'a' + 10;
+ if (isdigit(*cp))
+ value = *cp - '0';
+ else if (isalpha(*cp))
+ value = TOLOWER(*cp) - 'a' + 10;
+ else
+ break;
if (value >= base)
break;
+ if (result > (ULLONG_MAX - value) / base) {
+ result = ULLONG_MAX;
+ break;
+ }
result = result * base + value;
cp++;
}
@@ -86,7 +95,12 @@ EXPORT_SYMBOL(simple_strtoull);
*/
unsigned long simple_strtoul(const char *cp, char **endp, unsigned int base)
{
- return simple_strtoull(cp, endp, base);
+ unsigned long long result = simple_strtoull(cp, endp, base);
+
+ if (result <= ULONG_MAX)
+ return result;
+
+ return ULONG_MAX;
}
EXPORT_SYMBOL(simple_strtoul);