strtol and strtoul base should be [2, 36] or zero.

Coverity CID 104817 and CID 104836.

diff --git a/ext/POSIX/POSIX.xs b/ext/POSIX/POSIX.xs
index 216c47e..3a3533b 100644 (file)
--- a/ext/POSIX/POSIX.xs
+++ b/ext/POSIX/POSIX.xs
@@ -3429,20 +3429,29 @@ strtol(str, base = 0)
        long num;
        char *unparsed;
     PPCODE:
-       num = strtol(str, &unparsed, base);
+       if (base == 0 || (base >= 2 && base <= 36)) {
+            num = strtol(str, &unparsed, base);
 #if IVSIZE <= LONGSIZE
-       if (num < IV_MIN || num > IV_MAX)
-           PUSHs(sv_2mortal(newSVnv((double)num)));
-       else
-#endif
-           PUSHs(sv_2mortal(newSViv((IV)num)));
-       if (GIMME_V == G_ARRAY) {
-           EXTEND(SP, 1);
-           if (unparsed)
-               PUSHs(sv_2mortal(newSViv(strlen(unparsed))));
-           else
-               PUSHs(&PL_sv_undef);
-       }
+            if (num < IV_MIN || num > IV_MAX)
+                PUSHs(sv_2mortal(newSVnv((double)num)));
+            else
+#endif
+                PUSHs(sv_2mortal(newSViv((IV)num)));
+            if (GIMME_V == G_ARRAY) {
+                EXTEND(SP, 1);
+                if (unparsed)
+                    PUSHs(sv_2mortal(newSViv(strlen(unparsed))));
+                else
+                    PUSHs(&PL_sv_undef);
+            }
+        } else {
+           SETERRNO(EINVAL, LIB_INVARG);
+            PUSHs(&PL_sv_undef);
+            if (GIMME_V == G_ARRAY) {
+               EXTEND(SP, 1);
+               PUSHs(&PL_sv_undef);
+            }
+        }
 
 void
 strtoul(str, base = 0)
@@ -3454,20 +3463,29 @@ strtoul(str, base = 0)
     PPCODE:
        PERL_UNUSED_VAR(str);
        PERL_UNUSED_VAR(base);
-       num = strtoul(str, &unparsed, base);
+       if (base == 0 || (base >= 2 && base <= 36)) {
+            num = strtoul(str, &unparsed, base);
 #if IVSIZE <= LONGSIZE
-       if (num > IV_MAX)
-           PUSHs(sv_2mortal(newSVnv((double)num)));
-       else
-#endif
-           PUSHs(sv_2mortal(newSViv((IV)num)));
-       if (GIMME_V == G_ARRAY) {
-           EXTEND(SP, 1);
-           if (unparsed)
-               PUSHs(sv_2mortal(newSViv(strlen(unparsed))));
-           else
-               PUSHs(&PL_sv_undef);
-       }
+            if (num > IV_MAX)
+                PUSHs(sv_2mortal(newSVnv((double)num)));
+            else
+#endif
+                PUSHs(sv_2mortal(newSViv((IV)num)));
+            if (GIMME_V == G_ARRAY) {
+                EXTEND(SP, 1);
+                if (unparsed)
+                    PUSHs(sv_2mortal(newSViv(strlen(unparsed))));
+                else
+                  PUSHs(&PL_sv_undef);
+            }
+       } else {
+           SETERRNO(EINVAL, LIB_INVARG);
+            PUSHs(&PL_sv_undef);
+            if (GIMME_V == G_ARRAY) {
+               EXTEND(SP, 1);
+               PUSHs(&PL_sv_undef);
+            }
+        }
 
 void
 strxfrm(src)