mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
a2663ec8d3
Fix two issues in boot menu input parsing: 1. ebcdic_strtoul returns unsigned long but the value was stored in an int. 2. ebcdic_strtoul could overflow if @value exceeds ULONG_MAX. Both problems are easy to trigger by entering an excessively large value in the boot menu, which can lead to unsigned long overflow and memory corruption. Use a checked addition to prevent overflow and change menu_read() return type to unsigned long. Suggested-by: Eduard Shishkin <edward6@linux.ibm.com> Reviewed-by: Eduard Shishkin <edward6@linux.ibm.com> Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
34 lines
698 B
C
34 lines
698 B
C
/*
|
|
* EBCDIC specific functions
|
|
*
|
|
* Copyright IBM Corp. 2013, 2020
|
|
*
|
|
* s390-tools is free software; you can redistribute it and/or modify
|
|
* it under the terms of the MIT license. See LICENSE for details.
|
|
*
|
|
*/
|
|
|
|
#include <limits.h>
|
|
|
|
#include "ebcdic.h"
|
|
|
|
/*
|
|
* Convert EBCDIC string to number with given base. In case of an overflow,
|
|
* ULONG_MAX is returned and @endptr is not updated.
|
|
*/
|
|
unsigned long ebcdic_strtoul(char *nptr, char **endptr, int base)
|
|
{
|
|
unsigned long val = 0;
|
|
|
|
while (ebcdic_isdigit(*nptr)) {
|
|
if (val != 0)
|
|
val *= base;
|
|
if (__builtin_uaddl_overflow(val, *nptr - 0xf0, &val))
|
|
return ULONG_MAX;
|
|
nptr++;
|
|
}
|
|
if (endptr)
|
|
*endptr = (char *)nptr;
|
|
return val;
|
|
}
|