Messages in this thread Patch in this message | | | Date | Sat, 2 May 2015 03:51:16 +0300 | From | Alexey Dobriyan <> | Subject | [PATCH 04/10] sscanf: fix overflow |
| |
Fun fact:
uint8_t val; sscanf("256", "%hhu", &val);
will return 1 (as it should), and make val=0 (as it should not).
Apart from correctness, patch allows to remove checks and switch to proper types in several (most?) cases:
grep -e 'scanf.*%[0-9]\+[dioux]' -n -r .
Such checks can be incorrect too, checking for 3 digits with %3u for parsing uint8_t is not enough.
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> ---
lib/vsprintf.c | 45 ++++++++++++++++++++++++++++++++++----------- 1 file changed, 34 insertions(+), 11 deletions(-)
--- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -2632,44 +2632,67 @@ int vsscanf(const char *buf, const char *fmt, va_list args) switch (qualifier) { case 'H': /* that's 'hh' in format */ - if (is_sign) + if (is_sign) { + if (val.s != (signed char)val.s) + goto out; *va_arg(args, signed char *) = val.s; - else + } else { + if (val.u != (unsigned char)val.u) + goto out; *va_arg(args, unsigned char *) = val.u; + } break; case 'h': - if (is_sign) + if (is_sign) { + if (val.s != (short)val.s) + goto out; *va_arg(args, short *) = val.s; - else + } else { + if (val.u != (unsigned short)val.u) + goto out; *va_arg(args, unsigned short *) = val.u; + } break; case 'l': - if (is_sign) + if (is_sign) { + if (val.s != (long)val.s) + goto out; *va_arg(args, long *) = val.s; - else + } else { + if (val.u != (unsigned long)val.u) + goto out; *va_arg(args, unsigned long *) = val.u; + } break; case 'L': - if (is_sign) + if (is_sign) { *va_arg(args, long long *) = val.s; - else + } else { *va_arg(args, unsigned long long *) = val.u; + } break; case 'Z': case 'z': + if (val.u != (size_t)val.u) + goto out; *va_arg(args, size_t *) = val.u; break; default: - if (is_sign) + if (is_sign) { + if (val.s != (int)val.s) + goto out; *va_arg(args, int *) = val.s; - else + } else { + if (val.u != (unsigned int)val.u) + goto out; *va_arg(args, unsigned int *) = val.u; + } break; } num++; str += len; } - +out: return num; } EXPORT_SYMBOL(vsscanf);
| |