mirror of
https://github.com/irssi/irssi.git
synced 2026-08-16 07:02:12 +02:00
Add parse_uint function to improve integer overflow handling
Originally found by oss-fuzz (issue 525) in get_ansi_color using ubsan. After a lot of analysis I'm 99% sure this isn't security relevant so it's fine to handle this publicly. The fix is mainly adding a function that does it right and use it everywhere. This is harder than it seems because the strtol() family of functions doesn't have the friendliest of interfaces. Aside from get_ansi_color(), there were other pieces of code that used the same (out*10+(*in-'0')) pattern, like the parse_size() and parse_time_interval() functions, which are mostly used for settings. Those are interesting cases, since they multiply the parsed number (resulting in more overflows) and they write to a signed integer parameter (which can accidentally make the uints negative without UB) Thanks to Pascal Cuoq for enlightening me about the undefined behavior of parse_size (and, in particular, the implementation-defined behavior of one of the WIP versions of this commit, where something like signed integer overflow happened, but it was legal). Also for writing tis-interpreter, which is better than ubsan to verify these things.
This commit is contained in:
parent
10cea61696
commit
632b0ce5e6
4 changed files with 130 additions and 27 deletions
|
|
@ -71,6 +71,7 @@ int expand_escape(const char **data);
|
|||
int nearest_power(int num);
|
||||
|
||||
/* Returns TRUE / FALSE */
|
||||
int parse_uint(const char *nptr, char **endptr, int base, guint *number);
|
||||
int parse_time_interval(const char *time, int *msecs);
|
||||
int parse_size(const char *size, int *bytes);
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue