Re: Signed integer overflow in telnet.

2024-08-26 Thread Todd C . Miller
On Mon, 26 Aug 2024 13:21:41 +0200, Omar Polo wrote: > I don't usually use telnet, but seemed simple to fix the hand rolled > parser to use strtonum > > OKs/opinions on the verbiage? Looks good. OK millert@ - todd

Re: Signed integer overflow in telnet.

2024-08-26 Thread Alexander Bluhm
On Mon, Aug 26, 2024 at 01:21:41PM +0200, Omar Polo wrote: > On 2024/08/25 20:55:09 -0700, Collin Funk wrote: > > "Theo de Raadt" writes: > > > > > Noone uses telnet, we (mostly) killed it! > > > > > > https://www.openbsd.org/images/tshirt-9b.jpg > > > > > > There is no way in heck this code is

Re: Signed integer overflow in telnet.

2024-08-26 Thread Omar Polo
On 2024/08/25 20:55:09 -0700, Collin Funk wrote: > "Theo de Raadt" writes: > > > Noone uses telnet, we (mostly) killed it! > > > > https://www.openbsd.org/images/tshirt-9b.jpg > > > > There is no way in heck this code is going to be converted in OpenBSD > > to use strtol(), which is even more wi

Re: Signed integer overflow in telnet.

2024-08-25 Thread Collin Funk
"Theo de Raadt" writes: > Noone uses telnet, we (mostly) killed it! > > https://www.openbsd.org/images/tshirt-9b.jpg > > There is no way in heck this code is going to be converted in OpenBSD > to use strtol(), which is even more willing to eat junk. I don't disagree. Especially on the strtol par

Re: Signed integer overflow in telnet.

2024-08-25 Thread Theo de Raadt
Noone uses telnet, we (mostly) killed it! https://www.openbsd.org/images/tshirt-9b.jpg There is no way in heck this code is going to be converted in OpenBSD to use strtol(), which is even more willing to eat junk. In our world, someone should adapt this to strtonum(), which is a cynical string t

Signed integer overflow in telnet.

2024-08-25 Thread Collin Funk
Hi, Earlier this week I committed this change in GNU Inetutils [1]. When sending the 'send dont ' telnet command, the value is not checked for overflow. Likewise for 'do', 'will', 'wont'. Another GNU Inetutils developer segfaults doing 'send dont 2147483648' and 'send dont 9223372034707292160' bu