X-Git-Url: http://git.droids-corp.org/?a=blobdiff_plain;f=lib%2Flibrte_cmdline%2Fcmdline_parse_num.c;h=d8cf37f06547c118e6eaf6d77a314fbd440c92f5;hb=0f9575b137aa5ce181d39fdb55e847c15f65f0a9;hp=832310d68e507c00ae661d859f80608b3d19d192;hpb=3031749c2df04a63cdcef186dcce3781e61436e8;p=dpdk.git

diff --git a/lib/librte_cmdline/cmdline_parse_num.c b/lib/librte_cmdline/cmdline_parse_num.c
index 832310d68e..d8cf37f065 100644
--- a/lib/librte_cmdline/cmdline_parse_num.c
+++ b/lib/librte_cmdline/cmdline_parse_num.c
@@ -119,10 +119,40 @@ add_to_res(unsigned int c, uint64_t *res, unsigned int base)
 	return 0;
 }
 
+static int
+check_res_size(struct cmdline_token_num_data *nd, unsigned ressize)
+{
+	switch (nd->type) {
+	case INT8:
+	case UINT8:
+		if (ressize < sizeof(int8_t))
+			return -1;
+		break;
+	case INT16:
+	case UINT16:
+		if (ressize < sizeof(int16_t))
+			return -1;
+		break;
+	case INT32:
+	case UINT32:
+		if (ressize < sizeof(int32_t))
+			return -1;
+		break;
+	case INT64:
+	case UINT64:
+		if (ressize < sizeof(int64_t))
+			return -1;
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
 
 /* parse an int */
 int
-cmdline_parse_num(cmdline_parse_token_hdr_t *tk, const char *srcbuf, void *res)
+cmdline_parse_num(cmdline_parse_token_hdr_t *tk, const char *srcbuf, void *res,
+	unsigned ressize)
 {
 	struct cmdline_token_num_data nd;
 	enum num_parse_state_t st = START;
@@ -141,6 +171,12 @@ cmdline_parse_num(cmdline_parse_token_hdr_t *tk, const char *srcbuf, void *res)
 
 	memcpy(&nd, &((struct cmdline_token_num *)tk)->num_data, sizeof(nd));
 
+	/* check that we have enough room in res */
+	if (res) {
+		if (check_res_size(&nd, ressize) < 0)
+			return -1;
+	}
+
 	while ( st != ERROR && c && ! cmdline_isendoftoken(c) ) {
 		debug_printf("%c %x -> ", c, c);
 		switch (st) {
@@ -358,7 +394,7 @@ cmdline_get_help_num(cmdline_parse_token_hdr_t *tk, char *dstbuf, unsigned int s
 	/* if (nd.type >= (sizeof(num_help)/sizeof(const char *))) */
 	/* return -1; */
 
-	ret = rte_snprintf(dstbuf, size, "%s", num_help[nd.type]);
+	ret = snprintf(dstbuf, size, "%s", num_help[nd.type]);
 	if (ret < 0)
 		return -1;
 	dstbuf[size-1] = '\0';