View | Details | Raw Unified | Return to bug 239978
Collapse All | Expand All

(-)sbin/ping/ping.c (-1 / +1 lines)
Lines 365-371 Link Here
365
			break;
365
			break;
366
		case 'h': /* Packet size increment for ping sweep */
366
		case 'h': /* Packet size increment for ping sweep */
367
			ltmp = strtol(optarg, &ep, 0);
367
			ltmp = strtol(optarg, &ep, 0);
368
			if (*ep || ep == optarg || ltmp < 1)
368
			if (*ep || ep == optarg || ltmp > (long)INT_MAX || ltmp < 1)
369
				errx(EX_USAGE, "invalid increment size: `%s'",
369
				errx(EX_USAGE, "invalid increment size: `%s'",
370
				    optarg);
370
				    optarg);
371
			if (uid != 0 && ltmp > DEFDATALEN) {
371
			if (uid != 0 && ltmp > DEFDATALEN) {

Return to bug 239978