DragonFlyBSD Kernel Audit
DF-2077 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/raid/vinum/vinumutil.c b/sys/dev/raid/vinum/vinumutil.c
@@ -199,8 +199,11 @@
 	    s++;					    /* skip */
 	}
 	if ((*s >= '0') && (*s <= '9')) {		    /* it's numeric */
-	    while ((*s >= '0') && (*s <= '9'))		    /* it's numeric */
+	    while ((*s >= '0') && (*s <= '9')) {	    /* it's numeric */
+		if (size > ((u_int64_t)-1) / 10)
+		    throw_rude_remark(EINVAL, "Length specification overflow: %s", spec);
 		size = size * 10 + *s++ - '0';		    /* convert it */
+	    }
 	    switch (*s) {
 	    case '\0':
 		return size * sign;