From c16ce12acb997e6ebd81eeb37bf5f9a20e95ea19 Mon Sep 17 00:00:00 2001 From: Martin Matuska Date: Sun, 23 Sep 2018 00:04:36 +0200 Subject: Correctly process and verify integer arguments passed to bsdcpio and bsdtar Fixes #1068 --- cpio/cpio.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) (limited to 'cpio') diff --git a/cpio/cpio.c b/cpio/cpio.c index 4b8ce792..9dddf417 100644 --- a/cpio/cpio.c +++ b/cpio/cpio.c @@ -134,8 +134,9 @@ main(int argc, char *argv[]) struct cpio _cpio; /* Allocated on stack. */ struct cpio *cpio; const char *errmsg; + char *tptr; int uid, gid; - int opt; + int opt, t; cpio = &_cpio; memset(cpio, 0, sizeof(*cpio)); @@ -204,9 +205,15 @@ main(int argc, char *argv[]) cpio->add_filter = opt; break; case 'C': /* NetBSD/OpenBSD */ - cpio->bytes_per_block = atoi(cpio->argument); - if (cpio->bytes_per_block <= 0) - lafe_errc(1, 0, "Invalid blocksize %s", cpio->argument); + errno = 0; + tptr = NULL; + t = (int)strtol(cpio->argument, &tptr, 10); + if (errno || t <= 0 || *(cpio->argument) == '\0' || + tptr == NULL || *tptr != '\0') { + lafe_errc(1, 0, "Invalid blocksize: %s", + cpio->argument); + } + cpio->bytes_per_block = t; break; case 'c': /* POSIX 1997 */ cpio->format = "odc"; -- cgit v1.2.1