|WARNING| argparse: support range step for corelist parsing

Stephen Hemminger stephen at networkplumber.org
Mon Oct 19 18:19:40 CEST 2026


On Mon, 19 Oct 2026 16:36:12 +0800
fengchengwen <fengchengwen at huawei.com> wrote:

> > When `step` is large and `min + step` exceeds `INT32_MAX`, the loop counter wraps around to a negative value, creating an infinite loop. The variables `min` and `max` are `int` (32-bit signed), and `step` is `int32_t`. If a malicious or mistaken user provides input like `"0-100:2147483647"`, the addition `min += step` will overflow after the first iteration.  
> 
> False positive, the:
> 		errno = 0;
> 		idx = strtol(value, &end, 10);
> 		last = end;
> 		if (errno || idx > UINT16_MAX) {
> 			ARGPARSE_LOG(ERR, "argument %s contains a numerical value out of range!",
> 				arg->name_long);
> 			return -EINVAL;
> 		}
> already treat such input as an error.

Since non-negative steps don't make sense, I would use strtoul() instead
and bound it by MAX_LCORE



More information about the dev mailing list