[PATCH] iio: core: fix signed integer overflow in

[PATCH] iio: core: fix signed integer overflow in

[Arnav Kapoor]

__iio_str_to_fixpoint() accumulates the integer part of the parsed number
into an int. Feeding it a string with more digits than an int can hold
overflows that variable, which is undefined behaviour. The same happens
when the parsed value is INT_MIN and the sign is applied afterwards.

The parser is reachable from userspace via the writable IIO channel
attributes, for example the "sampling_frequency" or "in_voltage_scale"
ones, and via the exported iio_str_to_fixpoint() helper used by a
number of IIO drivers. A user writing a long enough string therefore
triggers a signed integer overflow.

Accumulate the integer and the fractional part in a s64 and reject
values that do not fit into an int with -ERANGE. The limit for the
integer part depends on the sign as the sign is applied only after the
whole string has been parsed.

Signed-off-by: Arnav Kapoor <kapoorarnav43@gmail.com>
---
 drivers/iio/industrialio-core.c | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index d73f2541375f..40f4375163c3 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -1008,7 +1008,8 @@ static ssize_t iio_read_channel_info_avail(struct device *dev,
 static int __iio_str_to_fixpoint(const char *str, int fract_mult,
 				 int *integer, int *fract, bool scale_db)
 {
-	int i = 0, f = 0;
+	s64 i = 0, f = 0;
+	s64 limit;
 	bool integer_part = true, negative = false;
 
 	if (fract_mult == 0) {
@@ -1024,12 +1025,21 @@ static int __iio_str_to_fixpoint(const char *str, int fract_mult,
 		str++;
 	}
 
+	/*
+	 * The integer part is accumulated as a magnitude and the sign is only
+	 * applied once the whole string has been parsed. Hence the limit
+	 * depends on the sign.
+	 */
+	limit = negative ? (s64)INT_MAX + 1 : INT_MAX;
+
 	while (*str) {
 		if ('0' <= *str && *str <= '9') {
 			if (integer_part) {
-				i = i * 10 + *str - '0';
+				i = i * 10 + (*str - '0');
+				if (i > limit)
+					return -ERANGE;
 			} else {
-				f += fract_mult * (*str - '0');
+				f += (s64)fract_mult * (*str - '0');
 				fract_mult /= 10;
 			}
 		} else if (*str == '\n') {
@@ -1059,8 +1069,11 @@ static int __iio_str_to_fixpoint(const char *str, int fract_mult,
 			f = -f;
 	}
 
-	*integer = i;
-	*fract = f;
+	if (f < INT_MIN || f > INT_MAX)
+		return -ERANGE;
+
+	*integer = (int)i;
+	*fract = (int)f;
 
 	return 0;
 }