Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eb26374a authored by Treehugger Robot's avatar Treehugger Robot Committed by Automerger Merge Worker
Browse files

Merge "Relax integer limits in argument handling of native Zygote loop" into main am: 7f97613f

parents 4b148690 7f97613f
Loading
Loading
Loading
Loading
+13 −5
Original line number Diff line number Diff line
@@ -266,16 +266,24 @@ class NativeCommandBuffer {
  }
  // Picky version of atoi(). No sign or unexpected characters allowed. Return -1 on failure.
  static int digitsVal(char* start, char* end) {
    constexpr int vmax = std::numeric_limits<int>::max();
    int result = 0;
    if (end - start > 6) {
      return -1;
    }
    for (char* dp = start; dp < end; ++dp) {
      if (*dp < '0' || *dp > '9') {
        ALOGW("Argument failed integer format check");
        ALOGW("Argument contains non-integer characters");
        return -1;
      }
      int digit = *dp - '0';
      if (result > vmax / 10) {
        ALOGW("Argument exceeds int limit");
        return -1;
      }
      result *= 10;
      if (result > vmax - digit) {
        ALOGW("Argument exceeds int limit");
        return -1;
      }
      result = 10 * result + (*dp - '0');
      result += digit;
    }
    return result;
  }