[PATCH] Buggy integer conversion (integer overflow)

From: Tianyin Xu <tixu_at_cs.ucsd.edu>
Date: Fri, 28 Dec 2012 17:28:01 -0800

Hi all,

The following function in "src/Parsing.cc" is buggy. Basically, the
code is to get an int64_t number from the input string. However, "int
i" is defined as a 32-bit number.

So, a 64-bit input will be first truncated to a 32-bit integer and then
extended to a 64-bit integer as a return value.

 84 int64_t
 85 GetInteger64(void)
 86 {
 87 char *token = strtok(NULL, w_space);
 88 int i;
 89
 90 if (token == NULL)
 91 self_destruct();
 92
 93 i = strtoll(token, NULL, 10);
 94
 95 return i;
 96 }

I think we should at least use "int64_t" for "i" at line#88 instead of "int".

The patch is attached. The bug report is also available at
http://bugs.squid-cache.org/show_bug.cgi?id=3729

Thanks,
Tianyin

--
Tianyin XU,
http://cseweb.ucsd.edu/~tixu/

Received on Sat Dec 29 2012 - 01:28:09 MST

This archive was generated by hypermail 2.2.0 : Sat Dec 29 2012 - 12:00:50 MST