diff options
author | jdp <jdp@FreeBSD.org> | 2001-05-19 19:36:32 +0000 |
---|---|---|
committer | jdp <jdp@FreeBSD.org> | 2001-05-19 19:36:32 +0000 |
commit | a8fdb15db6fec27e9ebc57586662b2c7de9f1406 (patch) | |
tree | afc0e499d0f32318b7d346f3605060f0f1cefdf4 /sys | |
parent | aac9daff0f7d0228f61656dc35d461c5ea62d126 (diff) | |
download | FreeBSD-src-a8fdb15db6fec27e9ebc57586662b2c7de9f1406.zip FreeBSD-src-a8fdb15db6fec27e9ebc57586662b2c7de9f1406.tar.gz |
Fix a range checking bug in ng_int32_parse which affected 64-bit
machines. The code formerly read:
long val;
if (val < (long)-0x80000000 || ...)
return EINVAL;
The constant 0x80000000 has type unsigned int. The unary `-'
operator does not change the type (or the value, in this case).
Therefore the promotion to long is done by 0-extension, giving
0x0000000080000000 instead of the desired 0xffffffff80000000. I
got rid of the `-' and changed the cast to (int32_t) to give proper
sign-extension on all architectures and to better reflect the fact
that we are range-checking a 32-bit value.
This commit also makes the analogous changes to ng_int{8,16}_parse
for consistency.
MFC after: 3 days
Diffstat (limited to 'sys')
-rw-r--r-- | sys/netgraph/ng_parse.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/sys/netgraph/ng_parse.c b/sys/netgraph/ng_parse.c index cd545c3..5daf600 100644 --- a/sys/netgraph/ng_parse.c +++ b/sys/netgraph/ng_parse.c @@ -345,7 +345,7 @@ ng_int8_parse(const struct ng_parse_type *type, char *eptr; val = strtol(s + *off, &eptr, 0); - if (val < -0x80 || val > 0xff || eptr == s + *off) + if (val < (int8_t)0x80 || val > (u_int8_t)0xff || eptr == s + *off) return (EINVAL); *off = eptr - s; val8 = (int8_t)val; @@ -438,7 +438,8 @@ ng_int16_parse(const struct ng_parse_type *type, char *eptr; val = strtol(s + *off, &eptr, 0); - if (val < -0x8000 || val > 0xffff || eptr == s + *off) + if (val < (int16_t)0x8000 + || val > (u_int16_t)0xffff || eptr == s + *off) return (EINVAL); *off = eptr - s; val16 = (int16_t)val; @@ -531,8 +532,8 @@ ng_int32_parse(const struct ng_parse_type *type, char *eptr; val = strtol(s + *off, &eptr, 0); - if (val < (long)-0x80000000 - || val > (u_long)0xffffffff || eptr == s + *off) + if (val < (int32_t)0x80000000 + || val > (u_int32_t)0xffffffff || eptr == s + *off) return (EINVAL); *off = eptr - s; val32 = (int32_t)val; |