(allocated_size): Now size_t, and now initialized to 0.

(prepare_record_buffer): Arg is now size_t.
Remove now-useless casts.

(main): Use `long' for status, so that it can store ssize_t.
Use daddr_t, mode_t, size_t, off_t when appropriate.
Convert daddr_t and off_t values ourselves, since they might be longer
than long.  Convert other types using `long' primitives.
When processing MTIOCTOP, do not try to pass resulting
count back, since it won't work (it could be too large) and it's
not expected anyway.

diff --git a/src/rmt.c b/src/rmt.c
index 27b3f094ca2ca79681a83694c79e7d7e4728524a..d8aebba3e6b728675a2484dbdb743980e3aac439 100644 (file)
--- a/src/rmt.c
+++ b/src/rmt.c
@@ -51,7 +51,7 @@ static int tape = -1;
 
 /* Buffer containing transferred data, and its allocated size.  */
 static char *record_buffer = NULL;
-static int allocated_size = -1;
+static size_t allocated_size = 0;
 
 /* Buffer for constructing the reply.  */
 static char reply_buffer[BUFSIZ];
@@ -142,7 +142,7 @@ get_string (char *string)
 `---*/
 
 static void
-prepare_record_buffer (int size)
+prepare_record_buffer (size_t size)
 {
   if (size <= allocated_size)
     return;
@@ -150,7 +150,7 @@ prepare_record_buffer (int size)
   if (record_buffer)
     free (record_buffer);
 
-  record_buffer = malloc ((size_t) size);
+  record_buffer = malloc (size);
 
   if (record_buffer == NULL)
     {
@@ -180,7 +180,7 @@ int
 main (int argc, char *const *argv)
 {
   char command;
-  int status;
+  long status;
 
   /* FIXME: Localisation is meaningless, unless --help and --version are
      locally used.  Localisation would be best accomplished by the calling
@@ -233,8 +233,8 @@ top:
           suspicious if it's right. -- mib.  */
 
        {
-         int old_mode = atoi (mode_string);
-         int new_mode = 0;
+         mode_t old_mode = atol (mode_string);
+         mode_t new_mode = 0;
 
          if ((old_mode & 3) == 0)
            new_mode |= O_RDONLY;
@@ -277,26 +277,69 @@ top:
       {
        char count_string[STRING_SIZE];
        char position_string[STRING_SIZE];
+       off_t count = 0;
+       int negative;
+       char *p;
 
        get_string (count_string);
        get_string (position_string);
        DEBUG2 ("rmtd: L %s %s\n", count_string, position_string);
 
-       status
-         = lseek (tape, (off_t) atol (count_string), atoi (position_string));
-       if (status < 0)
+       /* Parse count_string, taking care to check for overflow.
+          We can't use standard functions,
+          since off_t might be longer than long.  */
+
+       for (p = count_string;  *p == ' ' || *p == '\t';  p++)
+         continue;
+
+       negative = *p == '-';
+       p += negative || *p == '+';
+
+       for (;;)
+         {
+           int digit = *p++ - '0';
+           if (9 < (unsigned) digit)
+             break;
+           else
+             {
+               off_t c10 = 10 * count;
+               off_t nc = negative ? c10 - digit : c10 + digit;
+               if (c10 / 10 != count || (negative ? c10 < nc : nc < c10))
+                 {
+                   report_error_message (N_("Seek offset out of range"));
+                   exit (EXIT_FAILURE);
+                 }
+               count = nc;
+             }
+         }
+
+       count = lseek (tape, count, atoi (position_string));
+       if (count < 0)
          goto ioerror;
-       goto respond;
+
+       /* Convert count back to string for reply.
+          We can't use sprintf, since off_t might be longer than long.  */
+       p = count_string + sizeof count_string;
+       *--p = '\0';
+       do
+         *--p = '0' + (int) (count % 10);
+       while ((count /= 10) != 0);
+       
+       DEBUG1 ("rmtd: A %s\n", p);
+
+       sprintf (reply_buffer, "A%s\n", p);
+       write (1, reply_buffer, strlen (reply_buffer));
+       goto top;
       }
 
     case 'W':
       {
        char count_string[STRING_SIZE];
-       int size;
-       int counter;
+       size_t size;
+       size_t counter;
 
        get_string (count_string);
-       size = atoi (count_string);
+       size = atol (count_string);
        DEBUG1 ("rmtd: W %s\n", count_string);
 
        prepare_record_buffer (size);
@@ -320,19 +363,19 @@ top:
     case 'R':
       {
        char count_string[STRING_SIZE];
-       int size;
+       size_t size;
 
        get_string (count_string);
        DEBUG1 ("rmtd: R %s\n", count_string);
 
-       size = atoi (count_string);
+       size = atol (count_string);
        prepare_record_buffer (size);
        status = read (tape, record_buffer, size);
        if (status < 0)
          goto ioerror;
-       sprintf (reply_buffer, "A%d\n", status);
+       sprintf (reply_buffer, "A%ld\n", status);
        write (1, reply_buffer, strlen (reply_buffer));
-       write (1, record_buffer, status);
+       write (1, record_buffer, (size_t) status);
        goto top;
       }
 
@@ -348,12 +391,43 @@ top:
 #ifdef MTIOCTOP
        {
          struct mtop mtop;
-
+         const char *p;
+         daddr_t count = 0;
+         int negative;
+
+         /* Parse count_string, taking care to check for overflow.
+            We can't use standard functions,
+            since daddr_t might be longer than long.  */
+         
+         for (p = count_string;  *p == ' ' || *p == '\t';  p++)
+           continue;
+         
+         negative = *p == '-';
+         p += negative || *p == '+';
+         
+         for (;;)
+           {
+             int digit = *p++ - '0';
+             if (9 < (unsigned) digit)
+               break;
+             else
+               {
+                 daddr_t c10 = 10 * count;
+                 daddr_t nc = negative ? c10 - digit : c10 + digit;
+                 if (c10 / 10 != count || (negative ? c10 < nc : nc < c10))
+                   {
+                     report_error_message (N_("Seek offset out of range"));
+                     exit (EXIT_FAILURE);
+                   }
+                 count = nc;
+               }
+           }
+
+         mtop.mt_count = count;
          mtop.mt_op = atoi (operation_string);
-         mtop.mt_count = atoi (count_string);
+
          if (ioctl (tape, MTIOCTOP, (char *) &mtop) < 0)
            goto ioerror;
-         status = mtop.mt_count;
        }
 #endif
        goto respond;
@@ -370,7 +444,7 @@ top:
          if (ioctl (tape, MTIOCGET, (char *) &operation) < 0)
            goto ioerror;
          status = sizeof (operation);
-         sprintf (reply_buffer, "A%d\n", status);
+         sprintf (reply_buffer, "A%ld\n", status);
          write (1, reply_buffer, strlen (reply_buffer));
          write (1, (char *) &operation, sizeof (operation));
        }
@@ -386,9 +460,9 @@ top:
     }
 
 respond:
-  DEBUG1 ("rmtd: A %d\n", status);
+  DEBUG1 ("rmtd: A %ld\n", status);
 
-  sprintf (reply_buffer, "A%d\n", status);
+  sprintf (reply_buffer, "A%ld\n", status);
   write (1, reply_buffer, strlen (reply_buffer));
   goto top;