Reject negative unsigned string values

src/lib/functionlib.cpp

@@ -929,9 +929,18 @@ u64 to_u64(String s, u64 fallback)
 	String raw = trim(s);
 	if(raw == "")
 		return(fallback);
-	char* end = 0;
-	unsigned long long value = strtoull(raw.c_str(), &end, 10);
-	return(end && *end == 0 ? (u64)value : fallback);
+	u64 value = 0;
+	u64 offset = raw[0] == '+' ? 1 : 0;
+	if(offset == raw.size())
+		return(fallback);
+	for(; offset < raw.size(); offset++)
+	{
+		char c = raw[offset];
+		if(c < '0' || c > '9' || value > (UINT64_MAX - (u64)(c - '0')) / 10)
+			return(fallback);
+		value = value * 10 + (u64)(c - '0');
+	}
+	return(value);
 }
 
 s64 to_s64(String s, s64 fallback)