Fix integer overflow in extcon_count.c

Change-Id: I83ac1617238aa664f1c5c6d1cff0c6945f5b1940
Signed-off-by: lokilee73 <changjoo.lee@samsung.com>

diff --git a/src/extcon/extcon_count.c b/src/extcon/extcon_count.c
index 6e5df02..bb9914b 100644 (file)
--- a/src/extcon/extcon_count.c
+++ b/src/extcon/extcon_count.c
@@ -47,6 +47,7 @@ int extcon_update_count(int index, unsigned long count)
        int r;
        int ret = 0;
        char buf[BUF_MAX];
+       unsigned long value;
 
        fd = open(extcon_devices[index].str, O_RDWR | O_CREAT, 0644);
        if (fd < 0) {
@@ -62,9 +63,15 @@ int extcon_update_count(int index, unsigned long count)
        }
 
        buf[r] = '\0';
-       extcon_devices[index].count = strtoul(buf, NULL, 10);
-       extcon_devices[index].count += count;
-
+       value = strtoul(buf, NULL, 10);
+       if (value == ULONG_MAX && errno == ERANGE)
+               _E("converted value is over ULONG MAX(%lu)!", ULONG_MAX);
+       else if (value > ULONG_MAX - count)
+               value = ULONG_MAX;
+       else
+               value += count;
+
+       extcon_devices[index].count = value;
        lseek(fd, 0, SEEK_SET);
        _I("ext(%d) count %lu", index, extcon_devices[index].count);
        snprintf(buf, sizeof(buf), "%lu", extcon_devices[index].count);