use strtol instead of atoi to get range checking, etc

2 files changed, 27 insertions, 7 deletions

diff --git a/usr.bin/mg/basic.c b/usr.bin/mg/basic.c
index bb2e6b81245..e99ef337551 100644
--- a/usr.bin/mg/basic.c
+++ b/usr.bin/mg/basic.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: basic.c,v 1.8 2002/02/13 22:36:58 vincent Exp $	*/
+/*	$OpenBSD: basic.c,v 1.9 2002/02/14 22:50:43 vincent Exp $	*/
 
 /*
  *		Basic cursor motion commands.
@@ -462,9 +462,21 @@ gotoline(f, n)
 	char   buf[32];
 
 	if (!(f & FFARG)) {
+		char *tmp;
+		
 		if ((s = ereply("Goto line: ", buf, sizeof(buf))) != TRUE)
 			return s;
-		n = atoi(buf);
+		errno = 0;
+		n = strtol(buf, &tmp, 10);
+		if (buf[0] == '\0' || *tmp != '\0') {
+			ewprintf("Invalid number");
+			return FALSE;
+		}
+		if ((errno == ERANGE && (n == LONG_MAX || n == LONG_MIN)) ||
+		    (n > INT_MAX || n < INT_MIN)) {
+			ewprintf("Out of range");
+			return FALSE;
+		}
 	}
 	if (n >= 0) {
 		clp = lforw(curbp->b_linep);	/* "clp" is first line */
diff --git a/usr.bin/mg/extend.c b/usr.bin/mg/extend.c
index 440a26b1c26..e34d6cafb72 100644
--- a/usr.bin/mg/extend.c
+++ b/usr.bin/mg/extend.c
@@ -1,9 +1,9 @@
-/*	$OpenBSD: extend.c,v 1.19 2002/02/13 03:21:12 vincent Exp $	*/
+/*	$OpenBSD: extend.c,v 1.20 2002/02/14 22:50:43 vincent Exp $	*/
 
 /*
  *	Extended (M-X) commands, rebinding, and	startup file processing.
  */
-
+#include "chrdef.h"
 #include "def.h"
 #include "kbd.h"
 #include "funmap.h"
@@ -715,14 +715,21 @@ excline(line)
 	if (*line != '\0') {
 		*line++ = '\0';
 		line = skipwhite(line);
-		if ((*line >= '0' && *line <= '9') || *line == '-') {
+		if (ISDIGIT(*line) || *line == '-') {
 			argp = line;
 			line = parsetoken(line);
 		}
 	}
 	if (argp != NULL) {
+		char *tmp;
 		f = FFARG;
-		n = atoi(argp);
+		errno = 0;
+		n = strtol(argp, &tmp, 10);
+		if (*tmp != '\0')
+			return FALSE;
+		if ((errno == ERANGE && (n == LONG_MAX || n == LONG_MIN)) ||
+		    (n > INT_MAX || n < INT_MIN))
+			return FALSE;
 	}
 	if ((fp = name_function(funcp)) == NULL) {
 		ewprintf("Unknown function: %s", funcp);
@@ -752,7 +759,8 @@ excline(line)
 		if (*argp != '"') {
 			if (*argp == '\'')
 				++argp;
-			if (!(lp = lalloc((int) (line - argp) + BINDEXT))) {
+			if ((lp = lalloc((int) (line - argp) + BINDEXT)) ==
+			    NULL) {
 				status = FALSE;
 				goto cleanup;
 			}