wolfsshd: compare the terminated copy in GetConfigInt

- The zero check ran WSTRCMP() on the caller's buffer, which is a
  length-bounded slice of the config line and not NUL terminated, so it
  read past inSz and rejected valid "0" values whose slice had trailing
  text.
- Compare num, the NUL-terminated copy that atol() was given.

Issue: F-7213
pull/1144/head
John Safranek 2026-07-30 14:43:03 -07:00 committed by philljj
parent bdc61a3200
commit 773febc60c
2 changed files with 5 additions and 1 deletions

View File

@ -151,7 +151,7 @@ static long GetConfigInt(const char* in, int inSz, int isTime, void* heap)
WMEMCPY(num, in, sz);
num[sz] = '\0';
ret = atol(num);
if (ret == 0 && WSTRCMP(in, "0") != 0) {
if (ret == 0 && WSTRCMP(num, "0") != 0) {
ret = WS_BAD_ARGUMENT;
}
else if (ret > 0) {

View File

@ -301,6 +301,10 @@ static int test_ParseConfigLine(void)
{"Invalid login grace time", "LoginGraceTime wolfsshd", 1},
{"Bare multiplier m (no digit)", "LoginGraceTime m", 1},
{"Bare multiplier h (no digit)", "LoginGraceTime h", 1},
{"Valid login grace time zero", "LoginGraceTime 0", 0},
{"Valid login grace time zero minutes", "LoginGraceTime 0m", 0},
{"Valid login grace time zero hours", "LoginGraceTime 0h", 0},
{"Invalid zero padded login grace time", "LoginGraceTime 00", 1},
/* Permit empty password tests. */
{"Permit empty password no", "PermitEmptyPasswords no", 0},