shithub: riscv

Download patch

ref: b2d79920255fc405b972e4c900e47f4a1046e044
parent: d3f4786a1fcfb3cf8eba0cad2457622c6487e0e9
author: cinap_lenrek <cinap_lenrek@felloff.net>
date: Sun Feb 25 12:11:18 EST 2018 

kernel: properly handle bad attach specifiers

- only accept decimal for numeric device id's
- exclude negative device id's
- device id's out of range yield Enodev


--- a/sys/src/9/ip/devip.c
+++ b/sys/src/9/ip/devip.c
@@ -277,12 +277,12 @@
 static Chan*
 ipattach(char* spec)
 {
-	ulong dev;
 	Chan *c;
+	ulong dev;
 
-	dev = strtoul(spec, nil, 0);
+	dev = strtoul(spec, nil, 10);
 	if(dev >= Nfs)
-		error(Ebadspec);
+		error(Enodev);
 
 	qlock(&fslock);
 	if(ipfs[dev] == nil){
--- a/sys/src/9/pc/devvga.c
+++ b/sys/src/9/pc/devvga.c
@@ -90,7 +90,7 @@
 vgaattach(char* spec)
 {
 	if(*spec && strcmp(spec, "0"))
-		error(Eio);
+		error(Enodev);
 	return devattach('v', spec);
 }
 
--- a/sys/src/9/port/devaudio.c
+++ b/sys/src/9/port/devaudio.c
@@ -120,16 +120,13 @@
 static Chan*
 audioattach(char *spec)
 {
-	static int attached = 0;
+	static ulong attached = 0;
 	Audiochan *ac;
 	Audio *adev;
 	Chan *c;
-	int i;
+	ulong i;
 
-	if(spec != nil && *spec != '\0')
-		i = strtol(spec, 0, 10);
-	else
-		i = 0;
+	i = strtoul(spec, nil, 10);
 	for(adev = audiodevs; adev; adev = adev->next)
 		if(adev->ctlrno == i)
 			break;
--- a/sys/src/9/port/devbridge.c
+++ b/sys/src/9/port/devbridge.c
@@ -193,14 +193,14 @@
 }
 
 static Chan*
-bridgeattach(char* spec)
+bridgeattach(char *spec)
 {
 	Chan *c;
-	int dev;
+	ulong dev;
 
-	dev = atoi(spec);
-	if(dev<0 || dev >= Maxbridge)
-		error("bad specification");
+	dev = strtoul(spec, nil, 10);
+	if(dev >= Maxbridge)
+		error(Enodev);
 
 	c = devattach('B', spec);
 	mkqid(&c->qid, QID(0, Qtopdir), 0, QTDIR);
--- a/sys/src/9/port/devether.c
+++ b/sys/src/9/port/devether.c
@@ -25,7 +25,7 @@
 
 	ctlrno = 0;
 	if(*spec){
-		ctlrno = strtoul(spec, &conf, 0);
+		ctlrno = strtoul(spec, &conf, 10);
 		if(ctlrno >= MaxEther)
 			error(Enodev);
 		if(conf == spec)
--- a/sys/src/9/port/devflash.c
+++ b/sys/src/9/port/devflash.c
@@ -167,11 +167,11 @@
 flashattach(char *spec)
 {
 	Flash *f;
-	int bank;
 	Chan *c;
+	ulong bank;
 
-	bank = strtol(spec, nil, 0);
-	if(bank < 0 || bank >= Nbanks ||
+	bank = strtoul(spec, nil, 10);
+	if(bank >= Nbanks ||
 	   (f = flash.card[bank]) == nil ||
 	   f->attach != nil && f->attach(f) < 0)
 		error(Enodev);
--- a/sys/src/9/port/devloopback.c
+++ b/sys/src/9/port/devloopback.c
@@ -121,14 +121,11 @@
 	Queue *q;
 	Chan *c;
 	int chan;
-	int dev;
+	ulong dev;
 
-	dev = 0;
-	if(spec != nil){
-		dev = atoi(spec);
-		if(dev >= Nloopbacks)
-			error(Ebadspec);
-	}
+	dev = strtoul(spec, nil, 10);
+	if(dev >= Nloopbacks)
+		error(Enodev);
 
 	c = devattach('X', spec);
 	if(waserror()){
--- a/sys/src/9/port/devsd.c
+++ b/sys/src/9/port/devsd.c
@@ -662,8 +662,8 @@
 	if(spec[0] != 's' || spec[1] != 'd')
 		error(Ebadspec);
 	idno = spec[2];
-	subno = strtol(&spec[3], &p, 0);
-	if(p == &spec[3])
+	subno = strtol(&spec[3], &p, 10);
+	if(subno < 0 || p == &spec[3])
 		error(Ebadspec);
 
 	if((sdev=sdgetdev(idno)) == nil)
--- a/sys/src/9/port/devsdp.c
+++ b/sys/src/9/port/devsdp.c
@@ -364,14 +364,14 @@
 sdpattach(char* spec)
 {
 	Chan *c;
-	int dev;
 	char buf[100];
 	Sdp *sdp;
 	int start;
+	ulong dev;
 
-	dev = atoi(spec);
-	if(dev<0 || dev >= Nfs)
-		error("bad specification");
+	dev = strtoul(spec, nil, 10);
+	if(dev >= Nfs)
+		error(Enodev);
 
 	c = devattach('E', spec);
 	c->qid = (Qid){QID(0, Qtopdir), 0, QTDIR};
@@ -384,7 +384,7 @@
 	qunlock(sdp);
 
 	if(start) {
-		snprint(buf, sizeof(buf), "sdpackproc%d", dev);
+		snprint(buf, sizeof(buf), "sdpackproc%lud", dev);
 		kproc(buf, sdpackproc, sdp);
 	}