Bug fix: a numeric flag specification in the substitute command would

cause the next substitute flag to be ignored.
While working at it, detect and report overflows.

Reported by:	Jingsong Liu
MFC after:	1 week

1 files changed, 8 insertions, 2 deletions

diff --git a/usr.bin/sed/compile.c b/usr.bin/sed/compile.c
index ce8a46e..14ef81b 100644
--- a/usr.bin/sed/compile.c
+++ b/usr.bin/sed/compile.c
@@ -547,6 +547,7 @@ static char *
 compile_flags(char *p, struct s_subst *s)
 {
 	int gn;			/* True if we have seen g or n */
+	unsigned long nval;
 	char wfile[_POSIX2_LINE_MAX + 1], *q;
 
 	s->n = 1;				/* Default */
@@ -577,8 +578,13 @@ compile_flags(char *p, struct s_subst *s)
 				errx(1,
 "%lu: %s: more than one number or 'g' in substitute flags", linenum, fname);
 			gn = 1;
-			/* XXX Check for overflow */
-			s->n = (int)strtol(p, &p, 10);
+			errno = 0;
+			nval = strtol(p, &p, 10);
+			if (errno == ERANGE || nval > INT_MAX)
+				errx(1,
+"%lu: %s: overflow in the 'N' substitute flag", linenum, fname);
+			s->n = nval;
+			p--;
 			break;
 		case 'w':
 			p++;