57c4797
From d41715fc9f0050b18b8e976b92e02e86041ee448 Mon Sep 17 00:00:00 2001
57c4797
From: Dave Love <dave.love@manchester.ac.uk>
57c4797
Date: Sun, 14 May 2017 23:14:09 +0100
57c4797
Subject: [PATCH 16/30] Use strtol, not atoi
57c4797
57c4797
---
57c4797
 src/lib/message.c | 10 +++++++++-
57c4797
 1 file changed, 9 insertions(+), 1 deletion(-)
57c4797
57c4797
diff --git a/src/lib/message.c b/src/lib/message.c
57c4797
index 502cb454..f84537c7 100644
57c4797
--- a/src/lib/message.c
57c4797
+++ b/src/lib/message.c
57c4797
@@ -26,6 +26,7 @@
57c4797
 #include <string.h>
57c4797
 #include <stdarg.h>
57c4797
 #include <syslog.h>
57c4797
+#include <limits.h>
57c4797
 
57c4797
 #include "config.h"
57c4797
 #include "util/util.h"
57c4797
@@ -37,13 +38,20 @@ extern const char *__progname;
57c4797
 
57c4797
 void init(void) {
57c4797
     char *messagelevel_string = getenv("MESSAGELEVEL"); // Flawfinder: ignore (need to get string, validation in atol())
57c4797
+    char **endptr = &messagelevel_string;
57c4797
+    long l;
57c4797
 
57c4797
     openlog("Singularity", LOG_CONS | LOG_NDELAY, LOG_LOCAL0);
57c4797
 
57c4797
     if ( messagelevel_string == NULL ) {
57c4797
         messagelevel = 1;
57c4797
     } else {
57c4797
-        messagelevel = atoi(messagelevel_string); // Flawfinder: ignore
57c4797
+      l = strtol(messagelevel_string, endptr, 10);
57c4797
+        if (LONG_MIN == l || LONG_MAX == l || l < 0 || l > 9
57c4797
+            || (*messagelevel_string != '\0' && **endptr != '\0')) {
57c4797
+            singularity_message(VERBOSE, "Bad MESSAGELEVEL: %s\n", messagelevel_string);
57c4797
+        }
57c4797
+        messagelevel = l;
57c4797
         if ( messagelevel < 0 ) {
57c4797
             messagelevel = 0;
57c4797
         } else if ( messagelevel > 9 ) {
57c4797
-- 
57c4797
2.11.0
57c4797