1 files changed, 53 insertions, 19 deletions

diff --git a/src/s2wasm.h b/src/s2wasm.h
index bd3f12e73..a0ecfd710 100644
--- a/src/s2wasm.h
+++ b/src/s2wasm.h
@@ -160,19 +160,36 @@ private:
   }
 
   int32_t getInt() {
-    int32_t ret = 0;
+    const char* loc = s;
+    uint32_t value = 0;
     bool neg = false;
-    if (*s == '-') {
+    if (*loc == '-') {
       neg = true;
-      s++;
+      loc++;
     }
-    while (isdigit(*s)) {
-      ret *= 10;
-      ret += (*s - '0');
-      s++;
+    while (isdigit(*loc)) {
+      uint32_t digit = *loc - '0';
+      if (value > std::numeric_limits<uint32_t>::max() / 10) {
+        abort_on("uint32_t overflow");
+      }
+      value *= 10;
+      if (value > std::numeric_limits<uint32_t>::max() - digit) {
+        abort_on("uint32_t overflow");
+      }
+      value += digit;
+      loc++;
+    }
+    if (neg) {
+      uint32_t positive_int_min =
+          (uint32_t) - (1 + std::numeric_limits<int32_t>::min()) + (uint32_t)1;
+      if (value > positive_int_min) {
+        abort_on("negative int32_t overflow");
+      }
+      s = loc;
+      return -value;
     }
-    if (neg) ret = -ret;
-    return ret;
+    s = loc;
+    return value;
   }
 
   // gets a constant, which may be a relocation for later.
@@ -198,19 +215,36 @@ private:
   }
 
   int64_t getInt64() {
-    int64_t ret = 0;
+    const char* loc = s;
+    uint64_t value = 0;
     bool neg = false;
-    if (*s == '-') {
+    if (*loc == '-') {
       neg = true;
-      s++;
+      loc++;
     }
-    while (isdigit(*s)) {
-      ret *= 10;
-      ret += (*s - '0');
-      s++;
+    while (isdigit(*loc)) {
+      uint64_t digit = *loc - '0';
+      if (value > std::numeric_limits<uint64_t>::max() / 10) {
+        abort_on("uint64_t overflow");
+      }
+      value *= 10;
+      if (value > std::numeric_limits<uint64_t>::max() - digit) {
+        abort_on("uint64_t overflow");
+      }
+      value += digit;
+      loc++;
+    }
+    if (neg) {
+      uint64_t positive_int_min =
+          (uint64_t) - (1 + std::numeric_limits<int64_t>::min()) + (uint64_t)1;
+      if (value > positive_int_min) {
+        abort_on("negative int64_t overflow");
+      }
+      s = loc;
+      return -value;
     }
-    if (neg) ret = -ret;
-    return ret;
+    s = loc;
+    return value;
   }
 
   Name getCommaSeparated() {
@@ -933,7 +967,7 @@ private:
       } else if (match(".int64")) {
         size_t size = raw->size();
         raw->resize(size + 8);
-        (*(int64_t*)(&(*raw)[size])) = getInt();
+        (*(int64_t*)(&(*raw)[size])) = getInt64();
         zero = false;
       } else {
         break;