Import openssh_7.6p1.orig.tar.gz

1 files changed, 14 insertions, 4 deletions

diff --git a/openbsd-compat/fmt_scaled.c b/openbsd-compat/fmt_scaled.c
index e5533b2de..7c5193e26 100644
--- a/openbsd-compat/fmt_scaled.c
+++ b/openbsd-compat/fmt_scaled.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: fmt_scaled.c,v 1.13 2017/03/11 23:37:23 djm Exp $     */
+/*      $OpenBSD: fmt_scaled.c,v 1.16 2017/03/16 02:40:46 dtucker Exp $ */
 
 /*
  * Copyright (c) 2001, 2002, 2003 Ian F. Darwin.  All rights reserved.
@@ -125,22 +125,30 @@ scan_scaled(char *scaled, long long *result)
                                 /* ignore extra fractional digits */
                                 continue;
                         fract_digits++;         /* for later scaling */
-                        if (fpart >= LLONG_MAX / 10) {
+                        if (fpart > LLONG_MAX / 10) {
                                 errno = ERANGE;
                                 return -1;
                         }
                         fpart *= 10;
+                        if (i > LLONG_MAX - fpart) {
+                                errno = ERANGE;
+                                return -1;
+                        }
                         fpart += i;
                 } else {                                /* normal digit */
                         if (++ndigits >= MAX_DIGITS) {
                                 errno = ERANGE;
                                 return -1;
                         }
-                        if (whole >= LLONG_MAX / 10) {
+                        if (whole > LLONG_MAX / 10) {
                                 errno = ERANGE;
                                 return -1;
                         }
                         whole *= 10;
+                        if (i > LLONG_MAX - whole) {
+                                errno = ERANGE;
+                                return -1;
+                        }
                         whole += i;
                 }
         }
@@ -170,7 +178,9 @@ scan_scaled(char *scaled, long long *result)
                         }
                         scale_fact = scale_factors[i];
 
-                        if (whole >= LLONG_MAX / scale_fact) {
+                        /* check for overflow and underflow after scaling */
+                        if (whole > LLONG_MAX / scale_fact ||
+                            whole < LLONG_MIN / scale_fact) {
                                 errno = ERANGE;
                                 return -1;
                         }