upstream: fix off-by-one comparison for PerSourcePenalty

OpenBSD-Commit-ID: af4f5d01c41ef870b23e55655bfbf73474a6c02b

diff --git a/srclimit.c b/srclimit.c
index bac8ef667658e4adfb5253e097a1983566e5ebc3..6b8af4fb1e778635b2ce3378e4c0d9829886f232 100644 (file)
--- a/srclimit.c
+++ b/srclimit.c
@@ -261,7 +261,7 @@ srclimit_penalty_check_allow(int sock, const char **reason)
                        return 1;
                }
        }
-       if (npenalties > (size_t)penalty_cfg.max_sources &&
+       if (npenalties >= (size_t)penalty_cfg.max_sources &&
            penalty_cfg.overflow_mode == PER_SOURCE_PENALTY_OVERFLOW_DENY_ALL) {
                *reason = "too many penalised addresses";
                return 0;