[CritFix] Handle 0 length strings when converting to numbers

Issue: #5640

diff --git a/src/libserver/html/html_tag.hxx b/src/libserver/html/html_tag.hxx
index 6d41f13376822fe5e19c1fd6160f989a07373e10..4e4de3aa477bc0a79e21b438129c74a4528bf2fc 100644 (file)
--- a/src/libserver/html/html_tag.hxx
+++ b/src/libserver/html/html_tag.hxx
@@ -675,10 +675,13 @@ struct html_component_opacity : html_component_base {
        explicit html_component_opacity(std::string_view v)
                : raw_value(v)
        {
-               char *endptr;
-               auto val = std::strtof(v.data(), &endptr);
-               if (endptr != v.data() && val >= 0.0f && val <= 1.0f) {
-                       numeric_value = val;
+               char numbuf[128], *endptr = nullptr;
+               numbuf[0] = '\0';
+               rspamd_strlcpy(numbuf, v.data(), MIN(v.size(), sizeof(numbuf)));
+               auto num = g_ascii_strtod(numbuf, &endptr);
+
+               if (!std::isnan(num)) {
+                       numeric_value = num;
                }
        }
 

diff --git a/src/libutil/str_util.c b/src/libutil/str_util.c
index b3e47b7d4423941d32095133f6a936d9897f98d4..630e7550302348680a6ee9f4361858fb3a3f4485 100644 (file)
--- a/src/libutil/str_util.c
+++ b/src/libutil/str_util.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024 Vsevolod Stakhov
+ * Copyright 2025 Vsevolod Stakhov
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -367,8 +367,7 @@ gsize rspamd_strlcpy_fast(char *dst, const char *src, gsize siz)
        if (n-- != 0) {
                if (((uintptr_t) s & MEM_ALIGN) == ((uintptr_t) d & MEM_ALIGN)) {
                        /* Init copy byte by byte */
-                       for (; ((uintptr_t) s & MEM_ALIGN) && n && (*d = *s); n--, s++, d++)
-                               ;
+                       for (; ((uintptr_t) s & MEM_ALIGN) && n && (*d = *s); n--, s++, d++);
                        if (n && *s) {
                                wd = (void *) d;
                                ws = (const void *) s;
@@ -386,8 +385,7 @@ gsize rspamd_strlcpy_fast(char *dst, const char *src, gsize siz)
                }
 
                /* Copy the rest */
-               for (; n && (*d = *s); n--, s++, d++)
-                       ;
+               for (; n && (*d = *s); n--, s++, d++);
 
                *d = 0;
        }
@@ -459,6 +457,11 @@ rspamd_strtol(const char *s, gsize len, glong *value)
        const glong cutoff = G_MAXLONG / 10, cutlim = G_MAXLONG % 10;
        gboolean neg;
 
+       /* Avoid absurd length */
+       if (len == 0 || len > sizeof("-18446744073709551615")) {
+               return FALSE;
+       }
+
        /* Case negative values */
        if (*p == '-') {
                neg = TRUE;
@@ -527,6 +530,9 @@ rspamd_strtoul(const char *s, gsize len, gulong *value)
        gulong v = 0;
        const gulong cutoff = G_MAXULONG / 10, cutlim = G_MAXULONG % 10;
 
+       if (len == 0 || len > sizeof("-18446744073709551615")) {
+               return FALSE;
+       }
        /* Some preparations for range errors */
        CONV_STR_LIM_DECIMAL(G_MAXULONG);
 
@@ -2936,17 +2942,14 @@ gsize rspamd_memcspn(const char *s, const char *e, gsize len)
        const char *p = s, *end = s + len;
 
        if (!e[1]) {
-               for (; p < end && *p != *e; p++)
-                       ;
+               for (; p < end && *p != *e; p++);
                return p - s;
        }
 
        memset(byteset, 0, sizeof byteset);
 
-       for (; *e && BITOP(byteset, *(unsigned char *) e, |=); e++)
-               ;
-       for (; p < end && !BITOP(byteset, *(unsigned char *) p, &); p++)
-               ;
+       for (; *e && BITOP(byteset, *(unsigned char *) e, |=); e++);
+       for (; p < end && !BITOP(byteset, *(unsigned char *) p, &); p++);
 
        return p - s;
 }
@@ -2957,17 +2960,14 @@ gsize rspamd_memspn(const char *s, const char *e, gsize len)
        const char *p = s, *end = s + len;
 
        if (!e[1]) {
-               for (; p < end && *p == *e; p++)
-                       ;
+               for (; p < end && *p == *e; p++);
                return p - s;
        }
 
        memset(byteset, 0, sizeof byteset);
 
-       for (; *e && BITOP(byteset, *(unsigned char *) e, |=); e++)
-               ;
-       for (; p < end && BITOP(byteset, *(unsigned char *) p, &); p++)
-               ;
+       for (; *e && BITOP(byteset, *(unsigned char *) e, |=); e++);
+       for (; p < end && BITOP(byteset, *(unsigned char *) p, &); p++);
 
        return p - s;
 }