2004-12-19 Dmitry V. Levin <ldv@altlinux.org>

	* syscall.c (qual_signal): Check bounds for numeric signal names.
	Fix parser of symbolic signal names.
	Fix return code, as required by qualify() function.
	* syscall.c (qual_desc): Check bounds for descriptor number.
	* syscall.c (qual_syscall): Correct return code, to be consistent
	with qualify() and other qual_* functions.
	Fixes RH#143362.

diff --git a/syscall.c b/syscall.c
index 524171c5f8551314db6cbae04016eff804a2487f..a02b03cfebd56aadc2d56e6f98cac92c8042a00f 100644 (file)
--- a/syscall.c
+++ b/syscall.c
@@ -289,15 +289,15 @@ qual_syscall(s, opt, not)
        int not;
 {
        int i;
-       int any = 0;
+       int rc = -1;
 
        for (i = 0; i < nsyscalls; i++) {
                if (strcmp(s, sysent[i].sys_name) == 0) {
                        qualify_one(i, opt, not);
-                       any = 1;
+                       rc = 0;
                }
        }
-       return !any;
+       return rc;
 }
 
 static int
@@ -309,12 +309,15 @@ qual_signal(s, opt, not)
        int i;
        char buf[32];
 
-       if (s && *s && isdigit((unsigned char)*s)) {
-               qualify_one(atoi(s), opt, not);
-               return 0;
+       if (s && *s && isdigit((unsigned char)*s)) {
+               int signo = atoi(s);
+               if (signo < 0 || signo >= MAX_QUALS)
+                       return -1;
+               qualify_one(signo, opt, not);
+               return 0;
        }
        if (strlen(s) >= sizeof buf)
-               return 0;
+               return -1;
        strcpy(buf, s);
        s = buf;
        for (i = 0; s[i]; i++)
@@ -345,7 +348,10 @@ qual_desc(s, opt, not)
        int not;
 {
        if (s && *s && isdigit((unsigned char)*s)) {
-               qualify_one(atoi(s), opt, not);
+               int desc = atoi(s);
+               if (desc < 0 || desc >= MAX_QUALS)
+                       return -1;
+               qualify_one(desc, opt, not);
                return 0;
        }
        return -1;