Skip to content

Fightwarn - sscanf signed vs unsigned #856

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jimklimov merged 3 commits into from
Nov 11, 2020
Merged

Fightwarn - sscanf signed vs unsigned #856

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f7d2250
drivers/netxml-ups.c: rearrange sscanf() of inputs to avoid wrong int…
jimklimov Nov 8, 2020
6c09bd1
drivers/nutdrv_qx.c: upsdrv_initups(): constrain langid_fix scanned v…
jimklimov Nov 6, 2020
f349ed8
drivers/blazer_usb.c: upsdrv_initups(): constrain langid_fix scanned …
jimklimov Nov 8, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion drivers/blazer_usb.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -536,10 +536,12 @@ void upsdrv_initups(void)
/* check for language ID workaround (#1) */
if (getval("langid_fix")) {
/* skip "0x" prefix and set back to hexadecimal */
if (sscanf(getval("langid_fix") + 2, "%x", &langid_fix) != 1) {
unsigned int u_langid_fix;
if ( (sscanf(getval("langid_fix") + 2, "%x", &u_langid_fix) != 1) || (u_langid_fix > INT_MAX) ) {
upslogx(LOG_NOTICE, "Error enabling language ID workaround");
}
else {
langid_fix = u_langid_fix;
upsdebugx(2, "language ID workaround enabled (using '0x%x')", langid_fix);
}
}
Expand Down
24 changes: 22 additions & 2 deletions drivers/netxml-ups.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <limits.h>

#include <ne_request.h>
#include <ne_basic.h>
Expand Down Expand Up @@ -773,15 +774,34 @@ static int netxml_alarm_subscribe(const char *page)
/* due to different formats used by the various NMCs, we need to\
break up the reply in lines and parse each one separately */
for (s = strtok(resp_buf, "\r\n"); s != NULL; s = strtok(NULL, "\r\n")) {
long long int tmp_port = -1, tmp_secret = -1;
upsdebugx(2, "%s: parsing %s", __func__, s);

if (!strncasecmp(s, "<Port>", 6) && (sscanf(s+6, "%u", &port) != 1)) {
if (!strncasecmp(s, "<Port>", 6) && (sscanf(s+6, "%lli", &tmp_port) != 1)) {
return NE_RETRY;
}

if (!strncasecmp(s, "<Secret>", 8) && (sscanf(s+8, "%u", &secret) != 1)) {
/* FIXME? Does a port==0 make sense here? Or should the test below be for port<1?
* Legacy code until a fix here used sscanf() above to get a '%u' value...
*/
if (tmp_port < 0 || tmp_port > UINT_MAX) {
upsdebugx(2, "%s: parsing initial subcription failed, bad port value", __func__);
return NE_RETRY;
}

if (!strncasecmp(s, "<Secret>", 8) && (sscanf(s+8, "%lli", &tmp_secret) != 1)) {
return NE_RETRY;
}

if (tmp_secret < 0 || tmp_secret > UINT_MAX) {
upsdebugx(2, "%s: parsing initial subcription failed, bad secret value", __func__);
return NE_RETRY;
}

/* Range of valid values constrained above */
port = tmp_port;
secret = tmp_secret;

}

if ((port == -1) || (secret == -1)) {
Expand Down
4 changes: 3 additions & 1 deletion drivers/nutdrv_qx.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1944,9 +1944,11 @@ void upsdrv_initups(void)
/* Check for language ID workaround (#1) */
if (getval("langid_fix")) {
/* Skip "0x" prefix and set back to hexadecimal */
if (sscanf(getval("langid_fix") + 2, "%x", &langid_fix) != 1) {
unsigned int u_langid_fix;
if ( (sscanf(getval("langid_fix") + 2, "%x", &u_langid_fix) != 1) || (u_langid_fix > INT_MAX)) {
upslogx(LOG_NOTICE, "Error enabling language ID workaround");
} else {
langid_fix = u_langid_fix;
upsdebugx(2, "Language ID workaround enabled (using '0x%x')", langid_fix);
}
}
Expand Down