ed

commit 43caad39eb764d7de73bf651e97619afe339ceee
parent a53921fd16f367641afda0e4c4eca804f44453fe
Author: Roberto E. Vargas Caballero <k0ga@shike2.com>
Date:   Tue,  8 Dec 2015 20:44:38 +0100

Better overflow handling in getnum()

We were covering only the first part of the check,
but no the second part of the check.

Diffstat:
M
ed.c
 | 
10
++++++++--

1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/ed.c b/ed.c
@@ -293,14 +293,20 @@ skipblank(void)
 static int
 getnum(void)
 {
-	int ln;
+	int ln, n;
 
-	for (ln = 0; isdigit(*cmdp); ln += *cmdp++ - '0') {
+	for (ln = 0; isdigit(*cmdp); ln += n) {
 		if (ln > INT_MAX/10)
 			error("invalid address");
 		ln *= 10;
+		n = *cmdp++ - '0';
+		if (INT_MAX - ln < n)
+			error("invalid address");
 	}
 	return ln;
+
+invalid:
+	error("invalid address");
 }
 
 static int