statdb: Do stricter parsing validation

Match the validations done on input in dpkg-statoverride, so that we can
reuse this code when rewritting dpkg-statoverride in C.

debian/changelog

@@ -17,6 +17,8 @@ dpkg (1.15.5) UNRELEASED; urgency=low
     passed on the command line.
   * Abort on configure if the required C99 extensions are not supported.
   * Add C coding style document.
+  * Make dpkg as strict as dpkg-statoverride on input when validating the
+    parsed data from the statdb.
 
   [ Raphaël Hertzog ]
   * Add versioned dependency on base-files (>= 5.0.0) to dpkg-dev to ensure

src/statdb.c

@@ -52,9 +52,12 @@ statdb_parse_uid(const char *str)
 	uid_t uid;
 
 	if (str[0] == '#') {
-		uid = strtol(str + 1, &endptr, 10);
-		if (str + 1 == endptr || *endptr)
+		long int value;
+
+		value = strtol(str + 1, &endptr, 10);
+		if (str + 1 == endptr || *endptr || value < 0)
 			ohshit(_("syntax error: invalid uid in statoverride file"));
+		uid = (uid_t)value;
 	} else {
 		struct passwd* pw = getpwnam(str);
 		if (pw == NULL)
@@ -73,9 +76,12 @@ statdb_parse_gid(const char *str)
 	gid_t gid;
 
 	if (str[0] == '#') {
-		gid = strtol(str + 1, &endptr, 10);
-		if (str + 1 == endptr || *endptr)
+		long int value;
+
+		value = strtol(str + 1, &endptr, 10);
+		if (str + 1 == endptr || *endptr || value < 0)
 			ohshit(_("syntax error: invalid gid in statoverride file"));
+		gid = (gid_t)value;
 	} else {
 		struct group* gr = getgrnam(str);
 		if (gr == NULL)
@@ -91,13 +97,13 @@ mode_t
 statdb_parse_mode(const char *str)
 {
 	char* endptr;
-	mode_t mode;
+	long int mode;
 
 	mode = strtol(str, &endptr, 8);
-	if (str == endptr || *endptr)
+	if (str == endptr || *endptr || mode < 0 || mode > 07777)
 		ohshit(_("syntax error: invalid mode in statoverride file"));
 
-	return mode;
+	return (mode_t)mode;
 }
 
 void