Re: [PATCH v2 4/5] kconfig: prevent out-of-bounds user input for numeric options

[Nicolas Schier]

On Tue, Sep 15, 2026 at 10:15:07PM +0100, Julian Braha wrote:
> Currently, user input of out-of-bounds values for 'int' and 'hex' options
> is possible, leading to later silent failures in Kconfig if that value is
> used in a comparison, or a warning by GCC or error by Clang if used in the
> C code.
> 
> Let's factor out the out-of-bounds check on constants, so that it can be
> reused for checking user input.
> 
> The frontend will now reject an attempted user input of an out-of-bounds
> numeric value, similarly to how a value outside the active 'range' already
> does.
> 
> For migration of existing configurations, a .config file with an
> out-of-bounds numeric value will be allowed for now, but will warn the
> user when read in by confdata.c
> 
> Assisted-by: LLM
> Signed-off-by: Julian Braha <julianbraha@xxxxxxxxx>
> ---
>  scripts/kconfig/confdata.c                    |  6 +++++
>  scripts/kconfig/lkc_proto.h                   |  1 +
>  scripts/kconfig/menu.c                        | 19 +++-----------
>  scripts/kconfig/symbol.c                      | 20 +++++++++++++++
>  .../tests/err_num_bounds/expected_stderr      | 20 +++++++--------
>  scripts/kconfig/tests/warn_num_bounds/Kconfig | 24 ++++++++++++++++++
>  .../kconfig/tests/warn_num_bounds/__init__.py | 25 +++++++++++++++++++
>  scripts/kconfig/tests/warn_num_bounds/config  |  7 ++++++
>  .../tests/warn_num_bounds/expected_config     | 11 ++++++++
>  .../warn_num_bounds/expected_config_stderr    |  3 +++
>  .../warn_num_bounds/expected_frontend_config  | 11 ++++++++
>  .../warn_num_bounds/expected_frontend_stderr  |  0
>  12 files changed, 121 insertions(+), 26 deletions(-)
>  create mode 100644 scripts/kconfig/tests/warn_num_bounds/Kconfig
>  create mode 100644 scripts/kconfig/tests/warn_num_bounds/__init__.py
>  create mode 100644 scripts/kconfig/tests/warn_num_bounds/config
>  create mode 100644 scripts/kconfig/tests/warn_num_bounds/expected_config
>  create mode 100644 scripts/kconfig/tests/warn_num_bounds/expected_config_stderr
>  create mode 100644 scripts/kconfig/tests/warn_num_bounds/expected_frontend_config
>  create mode 100644 scripts/kconfig/tests/warn_num_bounds/expected_frontend_stderr
> 
> diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
> index 4234a51d16fd..2227d89d6328 100644
> --- a/scripts/kconfig/confdata.c
> +++ b/scripts/kconfig/confdata.c
> @@ -354,6 +354,12 @@ static int conf_set_sym_val(struct symbol *sym, int def, int def_flags, char *p)
>  	case S_INT:
>  	case S_HEX:
>  		if (sym_string_valid(sym, p)) {
> +			if (def != S_DEF_AUTO &&
> +			    !sym_string_check_bounds(sym, p))
> +				/* hex uses 64-bit unsigned integer */
> +				conf_warning("value '%s' for %s is outside the 64-bit %s integer bounds",
> +					     p, sym->name,
> +					     sym->type == S_INT ? "signed" : "unsigned");
>  			sym->def[def].val = xstrdup(p);
>  			sym->flags |= def_flags;
>  		} else {
> diff --git a/scripts/kconfig/lkc_proto.h b/scripts/kconfig/lkc_proto.h
> index 8914b4e8f2a8..8b436c87ba4a 100644
> --- a/scripts/kconfig/lkc_proto.h
> +++ b/scripts/kconfig/lkc_proto.h
> @@ -31,6 +31,7 @@ bool sym_set_tristate_value(struct symbol *sym,tristate tri);
>  void choice_set_value(struct menu *choice, struct symbol *sym);
>  tristate sym_toggle_tristate_value(struct symbol *sym);
>  bool sym_string_valid(struct symbol *sym, const char *newval);
> +bool sym_string_check_bounds(struct symbol *sym, const char *str);
>  bool sym_string_within_range(struct symbol *sym, const char *str);
>  bool sym_set_string_value(struct symbol *sym, const char *newval);
>  bool sym_is_changeable(const struct symbol *sym);
> diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
> index 2d8b0c65ce1e..6b9ef738ee71 100644
> --- a/scripts/kconfig/menu.c
> +++ b/scripts/kconfig/menu.c
> @@ -4,7 +4,6 @@
>   */
>  
>  #include <ctype.h>
> -#include <errno.h>
>  #include <stdarg.h>
>  #include <stdlib.h>
>  #include <string.h>
> @@ -239,8 +238,6 @@ void menu_add_symbol(enum prop_type type, struct symbol *sym, struct expr *dep)
>  static int menu_validate_number(struct symbol *sym, struct symbol *sym2,
>  				const struct property *prop)
>  {
> -	const char *type_bounds;
> -
>  	if (sym->type != S_INT && sym->type != S_HEX)
>  		return 0;
>  
> @@ -255,21 +252,11 @@ static int menu_validate_number(struct symbol *sym, struct symbol *sym2,
>  		return 1;
>  	}
>  
> -	errno = 0;
> -	if (sym->type == S_INT) {
> -		type_bounds = "64-bit signed integer";
> -		strtoll(sym2->name, NULL, 10);
> -	} else {
> -		/* hex */
> -		type_bounds = "64-bit unsigned integer";
> -		strtoull(sym2->name, NULL, 16);
> -	}
> -
> -	if (errno == ERANGE) {
> +	if (!sym_string_check_bounds(sym, sym2->name)) {
>  		fprintf(stderr,
> -			"%s:%d: error: %s constant '%s' is outside the %s bounds\n",
> +			"%s:%d: error: %s constant '%s' is outside the 64-bit %s bounds\n",

tests/err_num_bounds/expected_stderr wouldn't need to be updated here 
with 's/bounds/integer bounds/'; but AFAIC leave it as it is right now.

Reviewed-by: Nicolas Schier <n.schier@xxxxxxxxx>

-- 
Nicolas