From: dongshengyuan <545258830@qq.com>
Date: Fri, 10 Jul 2026 08:08:07 +0000 (+0800)
Subject: udevadm-control: reject oversized children-max
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=351e29e73971c061c0423eb5769a893367a7dcd5;p=thirdparty%2Fsystemd.git

udevadm-control: reject oversized children-max

The --children-max= option parsed into an unsigned value and then
stored it in an int sentinel field.

Values above INT_MAX could wrap negative and make the command look as
if no control option had been specified.

Reject oversized values before assigning the parsed value.

Reproducer:

$ udevadm control --children-max=2147483648
No control command option is specified.
$ echo $?
1

The value should be rejected as out of range instead of being wrapped
into the unset sentinel value.
---

diff --git a/src/udev/udevadm-control.c b/src/udev/udevadm-control.c
index 0a0bb35fb5d..cef3ec7fd56 100644
--- a/src/udev/udevadm-control.c
+++ b/src/udev/udevadm-control.c
@@ -125,6 +125,9 @@ static int parse_argv(int argc, char *argv[]) {
                         r = safe_atou(opts.arg, &i);
                         if (r < 0)
                                 return log_error_errno(r, "Failed to parse maximum number of children '%s': %m", opts.arg);
+                        if (i > INT_MAX)
+                                return log_error_errno(SYNTHETIC_ERRNO(ERANGE),
+                                                       "Maximum number of children is too large: %s", opts.arg);
                         arg_max_children = i;
                         break;
                 }
diff --git a/test/units/TEST-17-UDEV.sanity-check.sh b/test/units/TEST-17-UDEV.sanity-check.sh
index 6246638fc94..18326c03ad8 100755
--- a/test/units/TEST-17-UDEV.sanity-check.sh
+++ b/test/units/TEST-17-UDEV.sanity-check.sh
@@ -55,6 +55,7 @@ udevadm control -l notice
 udevadm control --log-level info
 udevadm control --log-level debug
 (! udevadm control -l hello)
+(! udevadm control -m 2147483648)
 
 # Check if processing queued events has been stopped.
 udevadm control --stop-exec-queue