lib/atoi/strtou_noneg.[ch]: Add strtou[l]l_noneg()

These functions reject negative numbers, instead of silently converting
them into unsigned, which strtou[l]l(3) do.

Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

lib/Makefile.am

@@ -30,6 +30,8 @@ libshadow_la_SOURCES = \
 	agetpass.h \
 	alloc.c \
 	alloc.h \
+	atoi/strtou_noneg.c \
+	atoi/strtou_noneg.h \
 	attr.h \
 	audit_help.c \
 	basename.c \

lib/atoi/strtou_noneg.c

@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: 2023, Alejandro Colomar <alx@kernel.org>
+// SPDX-License-Identifier: BSD-3-Clause
+
+
+#include <config.h>
+
+#include "atoi/strtou_noneg.h"
+
+
+extern inline unsigned long strtoul_noneg(const char *s,
+    char **restrict endp, int base);
+extern inline unsigned long long strtoull_noneg(const char *s,
+    char **restrict endp, int base);

lib/atoi/strtou_noneg.h

@@ -0,0 +1,47 @@
+// SPDX-FileCopyrightText: 2023, Alejandro Colomar <alx@kernel.org>
+// SPDX-License-Identifier: BSD-3-Clause
+
+
+#ifndef SHADOW_INCLUDE_LIB_ATOI_STRTOU_NONEG_H_
+#define SHADOW_INCLUDE_LIB_ATOI_STRTOU_NONEG_H_
+
+
+#include <config.h>
+
+#include <errno.h>
+#include <stdlib.h>
+
+#include "attr.h"
+
+
+ATTR_STRING(1) ATTR_ACCESS(write_only, 2)
+inline unsigned long strtoul_noneg(const char *s,
+    char **restrict endp, int base);
+ATTR_STRING(1) ATTR_ACCESS(write_only, 2)
+inline unsigned long long strtoull_noneg(const char *s,
+    char **restrict endp, int base);
+
+
+inline unsigned long
+strtoul_noneg(const char *s, char **restrict endp, int base)
+{
+	if (strtol(s, endp, base) < 0) {
+		errno = ERANGE;
+		return 0;
+	}
+	return strtoul(s, endp, base);
+}
+
+
+inline unsigned long long
+strtoull_noneg(const char *s, char **restrict endp, int base)
+{
+	if (strtol(s, endp, base) < 0) {
+		errno = ERANGE;
+		return 0;
+	}
+	return strtoull(s, endp, base);
+}
+
+
+#endif  // include guard