sscanf type mismatch

[setharnold]

swtpm/src/swtpm_ioctl/tpm_ioctl.c

Line 820 in 2579038

n = sscanf(&pos[1], "%u", tcp_port);

Hello, parse_tcp_optarg() takes an int *tcp_port parameter, and passes this to sscanf():

            n = sscanf(&pos[1], "%u", tcp_port);
            if (n != 1) {
                fprintf(stderr, "Invalid port '%s'\n", &pos[1]);
                return -1;
            }
            if (*tcp_port >= 65536) {
                fprintf(stderr, "Port '%s' outside valid range.\n",
                    &optarg[1]);
                return -1;
            }

My copy of sscanf(3) includes:

       u      Matches an unsigned decimal integer; the next pointer
              must be a pointer to unsigned int.

and fscanf(3posix) includes:

       u       Matches an optionally signed decimal integer, whose
               format is the same as expected for the subject
               sequence of strtoul() with the value 10 for the base
               argument. In the absence of a size modifier, the
               application shall ensure that the corresponding
               argument is a pointer to unsigned.

What happens if someone enters a number in the three billion range? Will it become vastly negative and easily pass the if (*tcp_port >= 65536) condition?

Does it matter?

Thanks

[stefanberger]

Passing --tcp :-1 would try to connect to port 65535, which was a bug.

[stefanberger]

Thanks for reporting this bug.