replace atoi() calls with strtol(). Follow the idiomatic pattern in our

manual page strictly.  Return -2 if the strings are not strict numbers.

The numbers remain in the range of "int".  Range checking for these parameters
is done later in the pkey_*_ctl() functions, or sometimes in functions much
further downstream... but not always!!!
ok millert miod mikeb

1 files changed, 30 insertions, 12 deletions

diff --git a/src/lib/libcrypto/dh/dh_pmeth.c b/src/lib/libcrypto/dh/dh_pmeth.c
index b51e0794b7..cb424ac149 100644
--- a/src/lib/libcrypto/dh/dh_pmeth.c
+++ b/src/lib/libcrypto/dh/dh_pmeth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_pmeth.c,v 1.5 2014/06/12 15:49:28 deraadt Exp $ */
+/* $OpenBSD: dh_pmeth.c,v 1.6 2014/06/12 20:40:57 deraadt Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -57,6 +57,7 @@
  */
 
 #include <stdio.h>
+#include <limits.h>
 #include "cryptlib.h"
 #include <openssl/asn1t.h>
 #include <openssl/x509.h>
@@ -143,21 +144,38 @@ static int pkey_dh_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
 static int pkey_dh_ctrl_str(EVP_PKEY_CTX *ctx,
                         const char *type, const char *value)
         {
-        if (!strcmp(type, "dh_paramgen_prime_len"))
-                {
-                int len;
-                len = atoi(value);
+        long lval;
+        char *ep;
+        int len;
+
+        if (!strcmp(type, "dh_paramgen_prime_len")) {
+                errno = 0;
+                lval = strtol(value, &ep, 10);
+                if (value[0] == '\0' || *ep != '\0')
+                        goto not_a_number;
+                if ((errno == ERANGE && (lval == LONG_MAX || lval == LONG_MIN)) ||
+                    (lval > INT_MAX || lval < INT_MIN))
+                        goto out_of_range;
+                len = lval;
                 return EVP_PKEY_CTX_set_dh_paramgen_prime_len(ctx, len);
-                }
-        if (!strcmp(type, "dh_paramgen_generator"))
-                {
-                int len;
-                len = atoi(value);
+        }
+        if (!strcmp(type, "dh_paramgen_generator")) {
+                errno = 0;
+                lval = strtol(value, &ep, 10);
+                if (value[0] == '\0' || *ep != '\0')
+                        goto not_a_number;
+                if ((errno == ERANGE && (lval == LONG_MAX || lval == LONG_MIN)) ||
+                    (lval > INT_MAX || lval < INT_MIN))
+                        goto out_of_range;
+                len = lval;
                 return EVP_PKEY_CTX_set_dh_paramgen_generator(ctx, len);
-                }
-        return -2;
         }
 
+not_a_number:
+out_of_range:
+        return -2;
+}
+
 static int pkey_dh_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
         {
         DH *dh = NULL;