diff --git a/sys/dev/raid/vinum/vinumutil.c b/sys/dev/raid/vinum/vinumutil.c @@ -199,8 +199,11 @@ s++; /* skip */ } if ((*s >= '0') && (*s <= '9')) { /* it's numeric */ - while ((*s >= '0') && (*s <= '9')) /* it's numeric */ + while ((*s >= '0') && (*s <= '9')) { /* it's numeric */ + if (size > ((u_int64_t)-1) / 10) + throw_rude_remark(EINVAL, "Length specification overflow: %s", spec); size = size * 10 + *s++ - '0'; /* convert it */ + } switch (*s) { case '\0': return size * sign;