From 351e29e73971c061c0423eb5769a893367a7dcd5 Mon Sep 17 00:00:00 2001
From: dongshengyuan <545258830@qq.com>
Date: Fri, 10 Jul 2026 16:08:07 +0800
Subject: [PATCH] udevadm-control: reject oversized children-max

The --children-max= option parsed into an unsigned value and then
stored it in an int sentinel field.

Values above INT_MAX could wrap negative and make the command look as
if no control option had been specified.

Reject oversized values before assigning the parsed value.

Reproducer:

$ udevadm control --children-max=2147483648
No control command option is specified.
$ echo $?
1

The value should be rejected as out of range instead of being wrapped
into the unset sentinel value.
---
 src/udev/udevadm-control.c              | 3 +++
 test/units/TEST-17-UDEV.sanity-check.sh | 1 +
 2 files changed, 4 insertions(+)

diff --git a/src/udev/udevadm-control.c b/src/udev/udevadm-control.c
index 0a0bb35fb5..cef3ec7fd5 100644
--- a/src/udev/udevadm-control.c
+++ b/src/udev/udevadm-control.c
@@ -125,6 +125,9 @@ static int parse_argv(int argc, char *argv[]) {
                         r = safe_atou(opts.arg, &i);
                         if (r < 0)
                                 return log_error_errno(r, "Failed to parse maximum number of children '%s': %m", opts.arg);
+                        if (i > INT_MAX)
+                                return log_error_errno(SYNTHETIC_ERRNO(ERANGE),
+                                                       "Maximum number of children is too large: %s", opts.arg);
                         arg_max_children = i;
                         break;
                 }
diff --git a/test/units/TEST-17-UDEV.sanity-check.sh b/test/units/TEST-17-UDEV.sanity-check.sh
index 6246638fc9..18326c03ad 100755
--- a/test/units/TEST-17-UDEV.sanity-check.sh
+++ b/test/units/TEST-17-UDEV.sanity-check.sh
@@ -55,6 +55,7 @@ udevadm control -l notice
 udevadm control --log-level info
 udevadm control --log-level debug
 (! udevadm control -l hello)
+(! udevadm control -m 2147483648)
 
 # Check if processing queued events has been stopped.
 udevadm control --stop-exec-queue