From 84404b99dcb6df8a85e009753bf71c3fda8df559 Mon Sep 17 00:00:00 2001 From: Jim Klimov Date: Sat, 1 Jun 2024 23:02:46 +0200 Subject: [PATCH] drivers/nutdrv_qx_bestups.c: bestups_batt_packs(): range-check and properly cast the value, and harden with snprintf_dynamic() [#2450] Signed-off-by: Jim Klimov --- drivers/nutdrv_qx_bestups.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-) diff --git a/drivers/nutdrv_qx_bestups.c b/drivers/nutdrv_qx_bestups.c index dc4ee1b919..c7d4882f8e 100644 --- a/drivers/nutdrv_qx_bestups.c +++ b/drivers/nutdrv_qx_bestups.c @@ -539,25 +539,20 @@ static int bestups_batt_runtime(item_t *item, char *value, const size_t valuelen static int bestups_batt_packs(item_t *item, char *value, const size_t valuelen) { item_t *unskip; + long l; if (strspn(item->value, "0123456789 ") != strlen(item->value)) { upsdebugx(2, "%s: non numerical value [%s: %s]", __func__, item->info_type, item->value); return -1; } -#ifdef HAVE_PRAGMAS_FOR_GCC_DIAGNOSTIC_IGNORED_FORMAT_NONLITERAL -#pragma GCC diagnostic push -#endif -#ifdef HAVE_PRAGMA_GCC_DIAGNOSTIC_IGNORED_FORMAT_NONLITERAL -#pragma GCC diagnostic ignored "-Wformat-nonliteral" -#endif -#ifdef HAVE_PRAGMA_GCC_DIAGNOSTIC_IGNORED_FORMAT_SECURITY -#pragma GCC diagnostic ignored "-Wformat-security" -#endif - snprintf(value, valuelen, item->dfl, strtol(item->value, NULL, 10)); -#ifdef HAVE_PRAGMAS_FOR_GCC_DIAGNOSTIC_IGNORED_FORMAT_NONLITERAL -#pragma GCC diagnostic pop -#endif + l = strtol(item->value, NULL, 10); + if (l < 0 || l > INT_MAX) { + upsdebugx(2, "%s: value out of range [%s: %s]", __func__, item->info_type, item->value); + return -1; + } + + snprintf_dynamic(value, valuelen, item->dfl, "%d", (int)l); /* Unskip battery.packs setvar */ unskip = find_nut_info("battery.packs", QX_FLAG_SETVAR, 0);