check_icmp: Fix parsing of single-char threshold

The threshold parser starts a pointer at the last character of the
string and walks it backwards until it reaches the second character.
This assumes the string is at least two characters long.  For a
single-character threshold such as "-w 1" or "-c 1", the pointer
underflows past the start of the string and keeps dereferencing memory
out of bounds.

Beyond the out-of-bounds reads, an out-of-bounds write can occur if a
stray '%' or ',' byte happens to turn up while scanning backwards.  In
that case, the parser writes a NUL byte at that out-of-bounds address
(the ',' case additionally re-reads forward from there via strtoul(3)).

Only run the descending scan when the string has at least two
characters, leaving the behaviour for all valid thresholds unchanged.

Reported-by: Christopher Kreft <Email@ChristopherKreft.de>

0 files changed, 0 insertions, 0 deletions