Fix potential integer overflow in getnum

[Crispy-fried-chicken]

Fix the vulnerability mentioned in #3626

[pjsg]

This should be targeted at the dev branch. And we probably need the same fix in the dev-esp32 branch.

[Crispy-fried-chicken]

This should be targeted at the dev branch. And we probably need the same fix in the dev-esp32 branch.

I've changed the branch to dev, and as for dev-esp32, maybe I can create another PR?

[pjsg]

Yeah -- create another PR. Thanks

…

On Sun, Feb 4, 2024 at 10:05 PM Yiheng Cao ***@***.***> wrote: This should be targeted at the dev branch. And we probably need the same fix in the dev-esp32 branch. I've changed the branch to dev, and as for dev-esp32, maybe I can create another PR? — Reply to this email directly, view it on GitHub <#3633 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AALQLTM5WJRXRRCVMBMIK43YSBD6LAVCNFSM6AAAAABCZMFNE2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSMRWGE2TCNJTGM> . You are receiving this because you commented.Message ID: ***@***.***>

[Crispy-fried-chicken]

and I see some checks were not successful, how I change to make it success?

[Crispy-fried-chicken]

I've already create another PR which is #3634, please check it, thank you!

[pjsg]

Hmm -- I have no idea why the checks failed..... I'm not sure who uses the 8266 dev branch....

[HHHartmann]

we need this fix on the release branch to fix the windows build issue:
193fe35#diff-5c3fa597431eda03ac3339ae6bf7f05e1a50d6fc7333679ec38e21b337cb6721

[pjsg]

Can you tee up a PR for that fix?

[HHHartmann]

Will do tomorrow

[HHHartmann]

Ah no, As it seems, you just need to rebase this branch onto a current dev branch which will also contain the fix.

[Crispy-fried-chicken]

@HHHartmann I don't see any fix about this PR in #3635, maybe you should add it to fix it?

[HHHartmann]

@Crispy-fried-chicken sorry, the fix on master is not required. I thought that the check pipleine needed to be updated on the release/master branch. But this is not needed.
Rebasing this branch to dev is what should fix the checks as the correct definition is there.

[Crispy-fried-chicken]

@pjsg Hi, is it necessary to apply for a CVE for this vulnerability? This is very important to recognize our work, thank you!