[openssl/openssl] 833efe: Remove remaining atoi()/atol() calls

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 833efe31fc163fb6216d6406396168cb87cea403
      https://github.com/openssl/openssl/commit/833efe31fc163fb6216d6406396168cb87cea403
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-07-29 (Wed, 29 Jul 2026)

  Changed paths:
    M apps/ca.c
    M apps/cmp.c
    M apps/lib/apps.c
    M apps/req.c
    M apps/s_client.c
    M apps/s_server.c
    M apps/speed.c
    M crypto/evp/ctrl_params_translate.c
    M crypto/mem.c
    M crypto/o_str.c
    M crypto/ppccap.c
    M crypto/ts/ts_conf.c
    M demos/digest/EVP_MD_xof.c
    M demos/pkey/EVP_PKEY_RSA_keygen.c
    M doc/man3/OPENSSL_malloc.pod
    M include/internal/cryptlib.h
    M providers/implementations/rands/seeding/rand_unix.c
    M providers/implementations/signature/rsa_sig.c
    M ssl/ssl_conf.c
    M test/evp_test.c
    M test/helpers/ssl_test_ctx.c
    M test/lhash_test.c
    M test/mfail/mfail.c
    M test/recipes/30-test_evp_data/evppkey_rsa_common.txt
    M test/ssl_old_test.c
    M test/testutil.h
    M test/testutil/driver.c
    M test/testutil/helper.c
    M test/timing_load_creds.c
    M util/platform_symbols/unix-symbols.txt
    M util/platform_symbols/windows-symbols.txt

  Log Message:
  -----------
  Remove remaining atoi()/atol() calls

Remove the remaining direct atoi()/atol() uses across apps, libcrypto,
libssl, providers, demos and tests, and route the replacements through
checked helpers instead of open-coding the conversion at each call site:

  - apps use the existing opt_int()/opt_long()/opt_int_arg() parsers;
  - libcrypto and provider code use the new internal ossl_strtol()/
    ossl_strtoint() helpers, a checked (and, for ossl_strtoint(),
    narrowing) signed counterpart to the public OPENSSL_strtoul();
  - libssl, demos and tests use OPENSSL_strtoul(); the test code shares
    a single test_strtoint() helper rather than repeating the bound check
    and cast per file;
  - unsigned values use OPENSSL_strtoul(), with call-site-specific range
    checks before narrowing where the destination type requires it.

Reject conversion failures and narrow through the helpers rather than
acting on garbage, and preserve the signed RSA-PSS saltlen sentinels
while rejecting invalid numeric strings. Add regression coverage for the
invalid RSA-PSS saltlen string path.

Fixes #8216

Assisted-by: OpenCode:GLM-5.2

Reviewed-by: Tom Cosgrove <[email protected]>
Reviewed-by: Tim Hudson <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Wed Jul 29 17:02:18 2026
(Merged from https://github.com/openssl/openssl/pull/31731)


  Commit: 1184d66238ad4a5d0168e295e761a4a95fe8b679
      https://github.com/openssl/openssl/commit/1184d66238ad4a5d0168e295e761a4a95fe8b679
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-07-29 (Wed, 29 Jul 2026)

  Changed paths:
    M test/build.info
    M test/strtoultest.c

  Log Message:
  -----------
  test/strtoultest: add coverage for ossl_strtol, ossl_strtoint and test_strtoint

Add direct unit tests for the three conversion helpers introduced to
replace atoi()/atol():

  - ossl_strtol: signed parse, including negative values, LONG_MIN/MAX
    boundaries, ERANGE on overflow, no-consumption and NULL-endptr
    full-consumption rules, NULL result/str, and the internal errno reset;
  - ossl_strtoint: narrowing to int (INT_MIN/MAX pass, +/-1 fail), long
    overflow, plus a NULL result;
  - test_strtoint: the test-util helper wrapping OPENSSL_strtoul(),
    covering negative rejection, trailing-garbage rejection, empty input,
    int and unsigned overflow, and the INT_MAX boundary.

Link strtoultest against the static libcrypto.a instead of the shared
library, since the internal ossl_* symbols are not exported (the version
script hides them with local: *).

Assisted-by: OpenCode:GLM-5.2

Reviewed-by: Tom Cosgrove <[email protected]>
Reviewed-by: Tim Hudson <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Wed Jul 29 17:02:19 2026
(Merged from https://github.com/openssl/openssl/pull/31731)


Compare: https://github.com/openssl/openssl/compare/c6f264b8c4b1...1184d66238ad

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/c6f264-1184d6%40github.com.