c/mirror_zfs
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_zfs.git synced 2025-01-27 10:24:22 +03:00
Code Issues Packages Projects Releases Wiki Activity

libzfs: Fix bounds checks for float parsing

Browse Source 
UINT64_MAX is not exactly representable as a double.

The closest representation is UINT64_MAX + 1, so we can use a >=
comparison instead of > for the bounds check.

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Ryan Moeller <ryan@iXsystems.com>
Closes #10127
This commit is contained in:
Ryan Moeller 2020-03-16 14:56:29 -04:00 committed by GitHub
parent 7261fc2e81
commit 4d32abaa87
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
cmd/ztest/ztest.c
View File

@ -648,7 +648,12 @@ nicenumtoull(const char *buf)
} else if (end[0] == '.') { } else if (end[0] == '.') {
double fval = strtod(buf, &end); double fval = strtod(buf, &end);
fval *= pow(2, str2shift(end)); fval *= pow(2, str2shift(end));
if (fval > UINT64_MAX) { /*
* UINT64_MAX is not exactly representable as a double.
* The closest representation is UINT64_MAX + 1, so we
* use a >= comparison instead of > for the bounds check.
*/
if (fval >= (double)UINT64_MAX) {
(void) fprintf(stderr, "ztest: value too large: %s\n", (void) fprintf(stderr, "ztest: value too large: %s\n",
buf); buf);
usage(B_FALSE); usage(B_FALSE);

7
lib/libzfs/libzfs_util.c
View File

@ -1411,7 +1411,12 @@ zfs_nicestrtonum(libzfs_handle_t *hdl, const char *value, uint64_t *num)
fval *= pow(2, shift); fval *= pow(2, shift);
if (fval > UINT64_MAX) { /*
* UINT64_MAX is not exactly representable as a double.
* The closest representation is UINT64_MAX + 1, so we
* use a >= comparison instead of > for the bounds check.
*/
if (fval >= (double)UINT64_MAX) {
if (hdl) if (hdl)
zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
"numeric value is too large")); "numeric value is too large"));