Denis Vlasenko spotted the lack of bounds checking in my first attempt at

itoa/utoa.

1 files changed, 14 insertions, 11 deletions

diff --git a/libbb/xfuncs.c b/libbb/xfuncs.c
index 00cacaadf..bcd0751ee 100644
--- a/libbb/xfuncs.c
+++ b/libbb/xfuncs.c
@@ -237,19 +237,21 @@ int wait4pid(int pid)
 // http://www.unix.org/whitepapers/64bit.html
 static char local_buf[12];
 
-void utoa_to_buf(unsigned n, char *buf, int buflen)
+void utoa_to_buf(unsigned n, char *buf, unsigned buflen)
 {
 	int i, out = 0;
-	for (i=1000000000; i; i/=10) {
-		int res = n/i;
-
-		if (res || out || i == 1) {
-			out++;
-			n -= res*i;
-			*buf++ = '0' + res;
+	if (buflen) {
+		for (i=1000000000; i; i/=10) {
+			int res = n/i;
+
+			if ((res || out || i == 1) && --buflen>0) {
+				out++;
+				n -= res*i;
+				*buf++ = '0' + res;
+			}
 		}
+		*buf = 0;
 	}
-	*buf = 0;
 }
 
 // Note: uses static buffer, calling it twice in a row will overwrite.
@@ -261,11 +263,12 @@ char *utoa(unsigned n)
 	return local_buf;
 }
 
-void itoa_to_buf(int n, char *buf, int buflen)
+void itoa_to_buf(int n, char *buf, unsigned buflen)
 {
-	if (n<0) {
+	if (buflen && n<0) {
 		n = -n;
 		*buf++ = '-';
+		buflen--;
 	}
 	utoa_to_buf((unsigned)n, buf, buflen);
 }