A "%f" sscanf conversion accepts the textual floating point literals "nan",
"inf" and "infinity", and an out-of-range magnitude such as "1e9999" is
converted to infinity. There are calculations and comparisons performed
with the values. They must therefore be well defined non-negative and
finite numbers.
Fixes: 302a41a73915 ("batctl: Add timeout filtering option for originators")
Fixes: e4a7b7733faf ("batctl: Add an optional interval for watch-mode")
Signed-off-by: Sven Eckelmann <[email protected]>
---
debug.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/debug.c b/debug.c
index 1cceea6..22cbcb8 100644
--- a/debug.c
+++ b/debug.c
@@ -10,6 +10,7 @@
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
+#include <math.h>
#include "debug.h"
#include "functions.h"
@@ -68,9 +69,10 @@ int handle_debug_table(struct state *state, int argc, char
**argv)
if (!optarg)
break;
- if (sscanf(optarg, "%f%c", &watch_interval, &tmp) != 1)
{
+ if (sscanf(optarg, "%f%c", &watch_interval, &tmp) != 1
||
+ !isfinite(watch_interval) || watch_interval < 0) {
fprintf(stderr,
- "Error - provided argument of '-%c' is
not a number\n",
+ "Error - provided argument of '-%c' is
not a positive number\n",
optchar);
return EXIT_FAILURE;
}
@@ -83,9 +85,10 @@ int handle_debug_table(struct state *state, int argc, char
**argv)
}
read_opt |= NO_OLD_ORIGS;
- if (sscanf(optarg, "%f%c", &orig_timeout, &tmp) != 1) {
+ if (sscanf(optarg, "%f%c", &orig_timeout, &tmp) != 1 ||
+ !isfinite(orig_timeout) || orig_timeout < 0) {
fprintf(stderr,
- "Error - provided argument of '-%c' is
not a number\n",
+ "Error - provided argument of '-%c' is
not a positive number\n",
optchar);
return EXIT_FAILURE;
}
--
2.47.3
