sh: Reject integer overflow in number and is_number.

1 files changed, 11 insertions, 3 deletions

diff --git a/bin/sh/mystring.c b/bin/sh/mystring.c
index 03ea8bac608c..19de78d9fd5d 100644
--- a/bin/sh/mystring.c
+++ b/bin/sh/mystring.c
@@ -82,9 +82,17 @@ number(const char *s)
 int
 is_number(const char *p)
 {
-	do {
-		if (! is_digit(*p))
+	const char *q;
+
+	if (*p == '\0')
+		return 0;
+	while (*p == '0')
+		p++;
+	for (q = p; *q != '\0'; q++)
+		if (! is_digit(*q))
 			return 0;
-	} while (*++p != '\0');
+	if (q - p > 10 ||
+	    (q - p == 10 && memcmp(p, "2147483647", 10) > 0))
+		return 0;
 	return 1;
 }