mirror of
https://github.com/gentoo-mirror/gentoo.git
synced 2026-08-05 00:28:09 -07:00
93098055bb
Closes: https://bugs.gentoo.org/296813 Closes: https://github.com/gentoo/gentoo/pull/24577 Signed-off-by: Patrice Clement <monsieurp@gentoo.org> Signed-off-by: Alessandro Barbieri <lssndrbarbieri@gmail.com>
29 lines
685 B
Diff
29 lines
685 B
Diff
--- a/lib/tre-parse.c
|
|
+++ b/lib/tre-parse.c
|
|
@@ -582,16 +582,23 @@
|
|
tre_parse_int(const tre_char_t **regex, const tre_char_t *regex_end)
|
|
{
|
|
int num = -1;
|
|
+ int overflow = 0;
|
|
const tre_char_t *r = *regex;
|
|
while (r < regex_end && *r >= L'0' && *r <= L'9')
|
|
{
|
|
if (num < 0)
|
|
num = 0;
|
|
- num = num * 10 + *r - L'0';
|
|
+ if (num <= (INT_MAX - 9) / 10) {
|
|
+ num = num * 10 + *r - L'0';
|
|
+ } else {
|
|
+ /* This digit could cause an integer overflow. We do not return
|
|
+ * directly; instead, consume all remaining digits. */
|
|
+ overflow = 1;
|
|
+ }
|
|
r++;
|
|
}
|
|
*regex = r;
|
|
- return num;
|
|
+ return overflow ? -1 : num;
|
|
}
|
|
|
|
|