From aa32555cb3d67406e22636b93f8bd2cbaf60b396 Mon Sep 17 00:00:00 2001
From: ed <ed@FreeBSD.org>
Date: Sun, 16 Aug 2015 13:59:11 +0000
Subject: [PATCH] Pick UINT_MAX / 100 as an upperbound.
The fix that I applied in r286798 is already good, but it assumes that
sizeof(int) > sizeof(short). Express the upperbound in terms of
UINT_MAX. By dividing that by 100, we're sure that the resulting value
is never larger than approximately UINT_MAX / 10, which is safe.
PR: 202326
Discussed with: kcwu csie org
MFC after: 1 month
---
sys/teken/teken.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/sys/teken/teken.c b/sys/teken/teken.c
index ef50e50035ae..8834390dec49 100644
--- a/sys/teken/teken.c
+++ b/sys/teken/teken.c
@@ -411,13 +411,16 @@ teken_state_numbers(teken_t *t, teken_char_t c)
/* First digit. */
t->t_stateflags &= ~TS_FIRSTDIGIT;
t->t_nums[t->t_curnum] = c - '0';
- } else if (t->t_nums[t->t_curnum] < USHRT_MAX) {
+ } else if (t->t_nums[t->t_curnum] < UINT_MAX / 100) {
/*
- * Screen positions are stored as unsigned
- * shorts. There is no need to continue parsing
- * input once the value exceeds USHRT_MAX. It
- * would only allow for integer overflows when
- * performing arithmetic on the cursor position.
+ * There is no need to continue parsing input
+ * once the value exceeds the size of the
+ * terminal. It would only allow for integer
+ * overflows when performing arithmetic on the
+ * cursor position.
+ *
+ * Ignore any further digits if the value is
+ * already UINT_MAX / 100.
*/
t->t_nums[t->t_curnum] =
t->t_nums[t->t_curnum] * 10 + c - '0';