From: "Theo de Raadt" <deraadt@openbsd.org>
Subject: Re: newsyslog: fix negative size limit bug
To: Jan Klemkow <j.klemkow@wemelug.de>
Cc: Alexander Bluhm <bluhm@openbsd.org>, tech@openbsd.org
Date: Wed, 23 Jul 2025 08:56:56 -0600

That looks better.

Something else to remember about strtonum() is that it won't allow
whitespace or garbage at either end of the number.  You can call
atoi() with "    123sdf" and get a result, but strtonum() will reject
this.  This means that numeric tokens must be correctly precisely cut
from the stream.

I can't tell if that is the case, because the newsyslog line parsing code
too artisanal.