From 7dd6850ea453a2b516017695599eec6b6836502b Mon Sep 17 00:00:00 2001
From: otto <otto@openbsd.org>
Date: Tue, 17 Feb 2004 16:13:33 +0000
Subject: [PATCH] Unbreak numeric flag parsing. Based on a fix from Jared
 Yanovich; this version with millert@. Resolves PR 3677.

ok millert@
---
 usr.bin/sed/compile.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/usr.bin/sed/compile.c b/usr.bin/sed/compile.c
index e1c304a53f0..4dacec407c3 100644
--- a/usr.bin/sed/compile.c
+++ b/usr.bin/sed/compile.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: compile.c,v 1.16 2003/10/07 17:56:26 deraadt Exp $	*/
+/*	$OpenBSD: compile.c,v 1.17 2004/02/17 16:13:33 otto Exp $	*/
 
 /*-
  * Copyright (c) 1992 Diomidis Spinellis.
@@ -35,7 +35,7 @@
 
 #ifndef lint
 /* from: static char sccsid[] = "@(#)compile.c	8.2 (Berkeley) 4/28/95"; */
-static char *rcsid = "$OpenBSD: compile.c,v 1.16 2003/10/07 17:56:26 deraadt Exp $";
+static char *rcsid = "$OpenBSD: compile.c,v 1.17 2004/02/17 16:13:33 otto Exp $";
 #endif /* not lint */
 
 #include <sys/types.h>
@@ -496,6 +496,7 @@ static char *
 compile_flags(char *p, struct s_subst *s)
 {
 	int gn;			/* True if we have seen g or n */
+	long l;
 	char wfile[_POSIX2_LINE_MAX + 1], *q;
 
 	s->n = 1;				/* Default */
@@ -526,9 +527,12 @@ compile_flags(char *p, struct s_subst *s)
 				err(COMPILE,
 "more than one number or 'g' in substitute flags");
 			gn = 1;
-			/* XXX Check for overflow */
-			s->n = (int)strtol(p, &p, 10);
-			break;
+			l = strtol(p, &p, 10);
+			if (l <= 0 || l >= INT_MAX)
+				err(COMPILE,
+				    "number in substitute flags out of range");
+			s->n = (int)l;
+			continue;
 		case 'w':
 			p++;
 #ifdef HISTORIC_PRACTICE