From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <maskray@sourceware.org>
Received: by sourceware.org (Postfix, from userid 7814)
 id 61E433858038; Sat, 28 Aug 2021 00:40:20 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 61E433858038
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Fangrui Song <maskray@sourceware.org>
To: glibc-cvs@sourceware.org
Subject: [glibc/google/grte/v5-2.27/master] wordexp: handle overflow in
 positional parameter number (bug 28011)
X-Act-Checkin: glibc
X-Git-Author: Andreas Schwab <schwab@linux-m68k.org>
X-Git-Refname: refs/heads/google/grte/v5-2.27/master
X-Git-Oldrev: 359a244dc60094ced02138ab9840a908d5f9410a
X-Git-Newrev: 6056776143dbc9cb0b62fc3c0f1ce5f44bbb3a71
Message-Id: <20210828004020.61E433858038@sourceware.org>
Date: Sat, 28 Aug 2021 00:40:20 +0000 (GMT)
X-BeenThere: glibc-cvs@sourceware.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Glibc-cvs mailing list <glibc-cvs.sourceware.org>
List-Unsubscribe: <https://sourceware.org/mailman/options/glibc-cvs>,
 <mailto:glibc-cvs-request@sourceware.org?subject=unsubscribe>
List-Archive: <https://sourceware.org/pipermail/glibc-cvs/>
List-Help: <mailto:glibc-cvs-request@sourceware.org?subject=help>
List-Subscribe: <https://sourceware.org/mailman/listinfo/glibc-cvs>,
 <mailto:glibc-cvs-request@sourceware.org?subject=subscribe>
X-List-Received-Date: Sat, 28 Aug 2021 00:40:20 -0000

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=6056776143dbc9cb0b62fc3c0f1ce5f44bbb3a71

commit 6056776143dbc9cb0b62fc3c0f1ce5f44bbb3a71
Author: Andreas Schwab <schwab@linux-m68k.org>
Date:   Fri Jun 25 15:02:47 2021 +0200

    wordexp: handle overflow in positional parameter number (bug 28011)
    
    Use strtoul instead of atoi so that overflow can be detected.

Diff:
---
 posix/wordexp-test.c | 1 +
 posix/wordexp.c      | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/posix/wordexp-test.c b/posix/wordexp-test.c
index cc29840355..30c1dd65ef 100644
--- a/posix/wordexp-test.c
+++ b/posix/wordexp-test.c
@@ -200,6 +200,7 @@ struct test_case_struct
     { 0, NULL, "$var", 0, 0, { NULL, }, IFS },
     { 0, NULL, "\"\\n\"", 0, 1, { "\\n", }, IFS },
     { 0, NULL, "", 0, 0, { NULL, }, IFS },
+    { 0, NULL, "${1234567890123456789012}", 0, 0, { NULL, }, IFS },
 
     /* Flags not already covered (testit() has special handling for these) */
     { 0, NULL, "one two", WRDE_DOOFFS, 2, { "one", "two", }, IFS },
diff --git a/posix/wordexp.c b/posix/wordexp.c
index 8e33ad95b0..b13b0d4b20 100644
--- a/posix/wordexp.c
+++ b/posix/wordexp.c
@@ -1407,7 +1407,7 @@ envsubst:
   /* Is it a numeric parameter? */
   else if (isdigit (env[0]))
     {
-      int n = atoi (env);
+      unsigned long n = strtoul (env, NULL, 10);
 
       if (n >= __libc_argc)
 	/* Substitute NULL. */