From: Patrick Steinhardt <ps@pks.im>
Date: Mon, 08 Sep 2025 04:04:22 GMT
Subject: Re: [PATCH] add-interactive: reject malformed numerical input
Message-ID: <aL5VxjPSqfXbnY7W@pks.im>
In-Reply-To: <aL15aTmKQOsNrF0D@Seonghyeons-Mac-Studio.local>

On Sun, Sep 07, 2025 at 09:24:09PM +0900, Seonghyeon Cho wrote:
> On Tue, Sep 02, 2025 at 11:07:59AM +0200, Patrick Steinhardt wrote:
> > In general though we're not doing a good job here of error checking. We
> > don't at all verify whether `strtoul()` returned an error, for example
> > ERANGE. So if a user passes an integer that exceeds whatever we can
> > store in an `unsigned long` we'll silently proceed with a bogus result,
> > won't we?
> > 
> > Ideally, we'd use a saner interface to parse these integers, like for
> > example our own `git_parse_ulong()`. But unfortunately, that interface
> > does not handle the case where we only want to parse a substring in a
> > longer string. Too bad.
> 
> Good point. Would you prefer I introduce new parse method here, or
> should this be handled in separate patch?

I don't think that would need to be part of your patch series. But we
should have proper error checking for `strtoul()` if we're already
improving this code.

Patrick