From cc6f1a6d7b92aa61806812ab40e7ede8ba288802 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Wed, 1 Jul 2026 09:06:30 +0200 Subject: [PATCH] libkmipclient: Fix kmip_parse_decimal_uint() to reject negative numbers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Function strtoull() silently accepts a leading '-' and returns a large positive number (two's complement wrap). Reject this by checking for the minus character. Assisted-by: IBM Bob:2.0.0 Signed-off-by: Ingo Franzki Reviewed-by: Finn Callies Signed-off-by: Jan Höppner --- libkmipclient/utils.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libkmipclient/utils.c b/libkmipclient/utils.c index 30b58aa5..e93dcf50 100644 --- a/libkmipclient/utils.c +++ b/libkmipclient/utils.c @@ -74,6 +74,8 @@ int kmip_parse_decimal_uint(const char *str, uint64_t *val) if (str == NULL) return -EINVAL; + if (str[0] == '-') + return -EBADMSG; errno = 0; v = strtoull(str, &endptr, 10);