atoi() used for ssh_port and server_port without error validation #59

New Issue

2026-07-20T17:14:08+02:00

TapTap commented

2026-07-20 17:14:08 +02:00

Description

In src/client/client_cli.c lines 94 and 163, atoi() is used to parse port numbers:

config->ssh_port = atoi(argv[++i]);         // line 94
server_port = atoi(argv[++i]);              // line 163

atoi() has no error detection — it returns 0 for invalid input (e.g., --ssh-port abc would silently set port to 0), and cannot distinguish between a valid "0" and an error. The server also doesn't validate that the port is within the valid range (1-65535).

Location

src/client/client_cli.c:94, 163

Suggested Fix

Use strtol() with proper error checking, consistent with how the server parses port numbers in src/server/server.c:167-173:

char* end;
long p = strtol(argv[i+1], &end, 10);
if (*end || p <= 0 || p > 65535) {
    fprintf(stderr, "Error: invalid port '%s' (must be 1-65535)\n", argv[i+1]);
    exit_code = 1;
    goto cleanup;
}
config->ssh_port = (int)p;
i++;

Severity

Medium

Category

Bug

## Description In `src/client/client_cli.c` lines 94 and 163, `atoi()` is used to parse port numbers: ```c config->ssh_port = atoi(argv[++i]); // line 94 server_port = atoi(argv[++i]); // line 163 ``` `atoi()` has no error detection — it returns 0 for invalid input (e.g., `--ssh-port abc` would silently set port to 0), and cannot distinguish between a valid "0" and an error. The server also doesn't validate that the port is within the valid range (1-65535). ## Location `src/client/client_cli.c:94, 163` ## Suggested Fix Use `strtol()` with proper error checking, consistent with how the server parses port numbers in `src/server/server.c:167-173`: ```c char* end; long p = strtol(argv[i+1], &end, 10); if (*end || p <= 0 || p > 65535) { fprintf(stderr, "Error: invalid port '%s' (must be 1-65535)\n", argv[i+1]); exit_code = 1; goto cleanup; } config->ssh_port = (int)p; i++; ``` ## Severity Medium ## Category Bug

TapTap referenced this issue

2026-07-20 18:37:04 +02:00

Fix logic/correctness bugs (#73, #68, #67, #66, #59, #58, #54, #48, #53) #78

TapTap referenced this issue from a commit

2026-07-20 19:04:40 +02:00

fix: logic/correctness bugs — issues #73, #68, #67, #66, #59, #58, #54, #48, #53

TapTap referenced this issue

2026-07-20 19:04:42 +02:00

Fix logic/correctness bugs (#73, #68, #67, #66, #59, #58, #54, #48, #53) #82

TapTap referenced this issue from a commit

2026-07-20 19:05:03 +02:00

Merge pull request 'Fix logic/correctness bugs (#73, #68, #67, #66, #59, #58, #54, #48, #53)' (#82) from fix/logic-correctness into main