Skip to content

L
lxc
Unverified Commit 71cfd6cc by Christian Brauner
Options

string_utils: fix parse_byte_size_string()

Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32475Signed-off-by: 's avatarChristian Brauner <christian.brauner@ubuntu.com>
parent 05eac3f2
Showing with 15 additions and 6 deletions
src/lxc/string_utils.c
...@@ -906,7 +906,7 @@ int parse_byte_size_string(const char *s, int64_t *converted) ...@@ -906,7 +906,7 @@ int parse_byte_size_string(const char *s, int64_t *converted)
char dup[INTTYPE_TO_STRLEN(int64_t)]; char dup[INTTYPE_TO_STRLEN(int64_t)];
char suffix[3] = {0}; char suffix[3] = {0};
if (!s || strequal(s, "")) if (is_empty_string(s))
return ret_errno(EINVAL); return ret_errno(EINVAL);
end = stpncpy(dup, s, sizeof(dup) - 1); end = stpncpy(dup, s, sizeof(dup) - 1);
...@@ -920,17 +920,26 @@ int parse_byte_size_string(const char *s, int64_t *converted) ...@@ -920,17 +920,26 @@ int parse_byte_size_string(const char *s, int64_t *converted)
else else
return ret_errno(EINVAL); return ret_errno(EINVAL);
if (suffix_len > 0 && (end - 2) == dup && !isdigit(*(end - 2))) if (suffix_len > 0) {
return ret_errno(EINVAL); if ((end - 1) == dup)
return ret_errno(EINVAL);
if (suffix_len > 0 && isalpha(*(end - 2))) if ((end - 2) == dup) {
suffix_len++; if (isalpha(*(end - 2)))
return ret_errno(EINVAL);
/* 1B */
} else {
if (isalpha(*(end - 2))) /* 12MB */
suffix_len++;
/* 12B */
}
if (suffix_len > 0) {
memcpy(suffix, end - suffix_len, suffix_len); memcpy(suffix, end - suffix_len, suffix_len);
*(suffix + suffix_len) = '\0'; *(suffix + suffix_len) = '\0';
*(end - suffix_len) = '\0'; *(end - suffix_len) = '\0';
} }
dup[lxc_char_right_gc(dup, strlen(dup))] = '\0'; dup[lxc_char_right_gc(dup, strlen(dup))] = '\0';
ret = lxc_safe_long_long(dup, &conv); ret = lxc_safe_long_long(dup, &conv);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment