From b6dede96ddfbba0907816181fea474a8041688c6 Mon Sep 17 00:00:00 2001
From: Rob Landley <rob@landley.net>
Date: Wed, 2 Sep 2026 17:49:45 -0500
Subject: [PATCH] Use long instead of ssize_t and check for negative values.

Various things in toybox use "int" for string lengths, on the theory
strlen(2 gigabytes) isn't exactly free even on modern hardware
(and the kernel trimmed each argv[] to int anyway last I checked).

Rather than audit for this, catch it in lib/ and switch callers to
use long() if/when somebody complains with a real test case.
---
 lib/lib.h   | 12 ++++++------
 lib/xwrap.c | 32 +++++++++++++++-----------------
 2 files changed, 21 insertions(+), 23 deletions(-)

diff --git a/lib/lib.h b/lib/lib.h
index d24a65e9..3b6ac80d 100644
--- a/lib/lib.h
+++ b/lib/lib.h
@@ -103,15 +103,15 @@ struct dirtree *dirtree_read(char *path, int (*callback)(struct dirtree *node));
 #define ABS_LAST 8 // don't resolve symlink in last path component
 
 // xwrap.c
-void xstrncpy(char *dest, char *src, size_t size);
-void xstrncat(char *dest, char *src, size_t size);
+void xstrncpy(char *dest, char *src, long size);
+void xstrncat(char *dest, char *src, long size);
 _Noreturn void _xexit(void);
 _Noreturn void xexit(void);
 void *xmmap(void *addr, size_t length, int prot, int flags, int fd, off_t off);
-void *xmalloc(size_t size);
-void *xzalloc(size_t size);
-void *xrealloc(void *ptr, size_t size);
-char *xstrndup(char *s, size_t n);
+void *xmalloc(long size);
+void *xzalloc(long size);
+void *xrealloc(void *ptr, long size);
+char *xstrndup(char *s, long n);
 char *xstrdup(char *s);
 void *xmemdup(void *s, long len);
 char *xmprintf(char *format, ...) printf_format;
diff --git a/lib/xwrap.c b/lib/xwrap.c
index fb608d57..3cd1503c 100644
--- a/lib/xwrap.c
+++ b/lib/xwrap.c
@@ -13,18 +13,18 @@
 // including null terminator. Exit if there's not enough space for the string
 // (including space for the null terminator), because silently truncating is
 // still broken behavior. (And leaving the string unterminated is INSANE.)
-void xstrncpy(char *dest, char *src, size_t size)
+void xstrncpy(char *dest, char *src, long size)
 {
-  if (strlen(src)+1 > size) error_exit("'%s' > %ld bytes", src, (long)size);
+  if (strlen(src)+1 > size) error_exit("'%s' > %ld bytes", src, size);
   strcpy(dest, src);
 }
 
-void xstrncat(char *dest, char *src, size_t size)
+void xstrncat(char *dest, char *src, long size)
 {
   long len = strlen(dest);
 
   if (len+strlen(src)+1 > size)
-    error_exit("'%s%s' > %ld bytes", dest, src, (long)size);
+    error_exit("'%s%s' > %ld bytes", dest, src, size);
   strcpy(dest+len, src);
 }
 
@@ -66,37 +66,35 @@ void *xmmap(void *addr, size_t length, int prot, int flags, int fd, off_t off)
 }
 
 // Die unless we can allocate memory.
-void *xmalloc(size_t size)
+void *xmalloc(long size)
 {
-  void *ret = malloc(size);
-  if (!ret) error_exit("xmalloc(%ld)", (long)size);
+  void *ret;
+  if (size<0 || !(ret = malloc(size))) error_exit("xmalloc(%ld)", (long)size);
 
   return ret;
 }
 
 // Die unless we can allocate prezeroed memory.
-void *xzalloc(size_t size)
+void *xzalloc(long size)
 {
-  void *ret = xmalloc(size);
-  memset(ret, 0, size);
-  return ret;
+  return memset(xmalloc(size), 0, size);
 }
 
 // Die unless we can change the size of an existing allocation, possibly
 // moving it.  (Notice different arguments from libc function.)
-void *xrealloc(void *ptr, size_t size)
+void *xrealloc(void *ptr, long size)
 {
-  ptr = realloc(ptr, size);
-  if (!ptr) error_exit("xrealloc");
+  if (size<0 || !(ptr = realloc(ptr, size))) error_exit("xrealloc %ld", size);
 
   return ptr;
 }
 
 // Die unless we can allocate a copy of this many bytes of string.
-char *xstrndup(char *s, size_t n)
+char *xstrndup(char *s, long size)
 {
-  char *ret = strndup(s, n);
-  if (!ret) error_exit("xstrndup");
+  char *ret;
+
+  if (size<0 ||!(ret = strndup(s, size))) error_exit("xstrndup");
 
   return ret;
 }
-- 
2.39.5