BusyBox Bug and Patch Tracking
BusyBox
  

Viewing Issue Simple Details Jump to Notes ] View Advanced ] Issue History ] Print ]
ID Category Severity Reproducibility Date Submitted Last Update
0001577 [uClibc] Other trivial always 11-07-07 02:44 06-02-08 16:22
Reporter patchman View Status public  
Assigned To uClibc
Priority normal Resolution fixed  
Status closed   Product Version 0.9.28.1
Summary 0001577: strtol accepts backtick as valid digit
Description strtol will not report an error if a backtick is part of the number-string to
convert. E.g. "5000`" will be converted to 50009. Looking at the code I see that
this is a corner case that is not checked:

...
digit = (((Wuchar)(*str - '0')) <= 9)
    ? (*str - '0')
    : ((*str >= 'A')
       ? (((0x20|(*str)) - 'a' + 10)) /* WARNING: assumes ascii. */
          : 40);

if (digit >= base) {
    break;
}
...

A backtick is 0x60. So it is greater than 'A'. 0x20|0x60 is 0x80. 0x80-'a'+10
evaluates to '9' which is accepted as a valid digit. This piece of code occurs
more than once in the code. The trunk seems to contain the bug, too.

The solution would be to explicitly check for this case.
Additional Information
Attached Files  strtol.patch [^] (607 bytes) 11-07-07 04:36

- Relationships

- Notes
(0002894)
patchman
11-07-07 03:12

Similar code seems to exist in the floating point versions of this routines. At
least when hexadecimal floats are enabled.
 
(0002895)
patchman
11-07-07 04:36

Small correction: 0x20|0x60 is 0x60. 0x60-'a'+10 evaluates to 9. I append a patch
that will fix this - maybe there is a more elegant way ...
 
(0007954)
vda
06-02-08 16:21

Fixed in rev 22191, thanks.
 

- Issue History
Date Modified Username Field Change
11-07-07 02:44 patchman New Issue
11-07-07 02:44 patchman Status new => assigned
11-07-07 02:44 patchman Assigned To  => uClibc
11-07-07 03:12 patchman Note Added: 0002894
11-07-07 04:36 patchman Note Added: 0002895
11-07-07 04:36 patchman File Added: strtol.patch
06-02-08 16:21 vda Status assigned => closed
06-02-08 16:21 vda Note Added: 0007954
06-02-08 16:22 vda Resolution open => fixed


Copyright © 2000 - 2006 Mantis Group
Powered by Mantis Bugtracker