⬢ DragonFlyBSD Kernel Audit
DF-2230 / fix.diff
← back to finding ↓ download raw
--- a/sys/libprop/prop_number.c
+++ b/sys/libprop/prop_number.c
@@ -542,6 +542,25 @@
 	if ((pnv->pnv_signed == INT64_MAX || pnv->pnv_signed == INT64_MIN) &&
 	    errno == ERANGE)
 	    	return (false);
+#else
+	/*
+	 * strtoq() saturates at INT64_MAX/INT64_MIN on overflow and the
+	 * kernel has no errno.  Detect the saturation by re-parsing the
+	 * same text with strtouq(): a genuine boundary value re-parses
+	 * identically, an overflowed one is strictly larger.  Failing
+	 * here lets the decimal unsigned fallback in
+	 * _prop_number_internalize() actually run.
+	 */
+	if (pnv->pnv_signed == INT64_MAX) {
+		if ((uint64_t)strtouq(ctx->poic_cp, NULL, 0) >
+		    (uint64_t)INT64_MAX)
+			return (false);
+	} else if (pnv->pnv_signed == INT64_MIN &&
+		   ctx->poic_cp[0] == '-') {
+		if ((uint64_t)strtouq(ctx->poic_cp + 1, NULL, 0) >
+		    (uint64_t)INT64_MAX + 1)
+			return (false);
+	}
 #endif
 	pnv->pnv_is_unsigned = false;
 	ctx->poic_cp = cp;