Replace atoi() and strtoull() on peer-controlled numeric fields with
bounded, error-reporting parsers. atoi() has undefined behavior on
overflow and cannot signal malformed input. strtoull() is C99, so it is
unavailable on some ports, and it accepts a leading sign and leading
whitespace that the SCP header does not permit.
- #2881 src/wolfscp.c: add ScpParseUInt64 helper; parse SCP header
file size / mtime / atime with digit validation and overflow
rejection against a caller-supplied max, replacing the 3 strtoull
call sites from de23a694. Also rejects "+1", " 1" and "\t1" on all
three fields, and "-1" on the unbounded scpMTime and scpATime, which
had taken the wrapped 0xFFFFFFFFFFFFFFFF. The helper takes the field
length, dropping the temporary '\n' written over the separating space
at each call site, and with it the <stdint.h> include de23a694 had
added for UINT32_MAX.
- #2882 src/wolfterm.c: add parseArg helper using strtol; clamp
invalid/out-of-range VT100 params to 0, replacing 2 atoi call
sites (blocks peer "-1" wrapping to 0xFFFFFFFF). A param with bytes
left over after its digits, such as "12x", clamps to 0 rather than
parsing as a short value. strtol is C89 and needs no replacement.
Inside USE_WINDOWS_API, so not built on Linux or macOS. Also drop
the unused maxIdx from getArgs().
Extend test_ScpGetFileSize and test_ScpGetTimestamp in tests/unit.c for
the fields the new parser rejects but strtoull() accepted: a signed or
whitespace-padded field, an empty field, a field holding a NUL, and the
64-bit maximum and one past it on the timestamps. Drop the strtoull()
and ERANGE references from those test comments.
Issue: F-2881, F-2882
e393bcb5d7