du: treat negative --max-depth values as errors

* NEWS: Mention the bug fix.
* src/du.c (main): Prefer ckd_add to check for overflow. Emit an error
if the value is negative.
* tests/du/max-depth.sh: Add a test case for the bug.

NEWS

@@ -12,6 +12,10 @@ GNU coreutils NEWS                                    -*- outline -*-
   will correctly match the last delimiter specified.
   [bug introduced with multi-byte support in coreutils-9.11]
 
+  'du --max-depth=N' now exits with a nonzero exit status and an error message
+  if N is negative.  Previously it behaved as if N were zero.
+  [bug introduced in coreutils-9.4]
+
   'head' and 'tail' now quote names in file headers when needed.
   [This bug was present in "the beginning".]
 

src/du.c

@@ -860,11 +860,8 @@ main (int argc, char **argv)
           {
             intmax_t tmp;
             if (xstrtoimax (optarg, NULL, 0, &tmp, "") == LONGINT_OK
-                && tmp <= IDX_MAX)
-              {
-                max_depth_specified = true;
-                max_depth = tmp;
-              }
+                && ! ckd_add (&max_depth, tmp, 0) && 0 <= max_depth)
+              max_depth_specified = true;
             else
               {
                 error (0, 0, _("invalid maximum depth %s"),

tests/du/max-depth.sh

@@ -36,4 +36,15 @@ cut -f2- out > k && mv k out
 compare exp out || fail=1
 compare /dev/null err || fail=1
 
+# Repeat, but use -d -1 and check for an error.
+# coreutils 9.4 to 9.11 would mistakenly behave as if --max-depth=0 were
+# specified when given a negative value.
+cat <<\EOF >exp || framework_failure_
+du: invalid maximum depth '-1'
+Try 'du --help' for more information.
+EOF
+returns_ 1 du -d -1 a >out 2>err || fail=1
+compare /dev/null out || fail=1
+compare exp err || fail=1
+
 Exit $fail