From 5020fbcb1772a7528635bca8d00a9d35a87b2516 Mon Sep 17 00:00:00 2001
From: serassio <>
Date: Sat, 26 Aug 2006 17:38:56 +0000
Subject: [PATCH] Bug #1708: Ports in ACL accepts characters and out of range

- Renamed aclParseIntRange() to aclParsePortRange()
- Added check on numeric value
- Added check if range is ascending
- Also fixed a dump error

Forward port of a 2.6 patch.
---
 src/ACLIntRange.cc | 38 ++++++++++++++++++++++++++------------
 1 file changed, 26 insertions(+), 12 deletions(-)

diff --git a/src/ACLIntRange.cc b/src/ACLIntRange.cc
index 2ddb1d4f60..b69f516929 100644
--- a/src/ACLIntRange.cc
+++ b/src/ACLIntRange.cc
@@ -1,5 +1,5 @@
 /*
- * $Id: ACLIntRange.cc,v 1.7 2006/04/23 11:10:31 robertc Exp $
+ * $Id: ACLIntRange.cc,v 1.8 2006/08/26 11:38:56 serassio Exp $
  *
  * DEBUG: section 28    Access Control
  * AUTHOR: Robert Collins
@@ -49,16 +49,30 @@ ACLIntRange::parse()
     char *t = NULL;
 
     while ((t = strtokFile())) {
-        RangeType temp (0,0);
-        temp.start = atoi(t);
-        t = strchr(t, '-');
-
-        if (t && *(++t))
-            temp.end = atoi(t) + 1;
-        else
-            temp.end = temp.start+1;
-
-        ranges.push_back(temp);
+        int port = atoi(t);
+
+        if (port > 0 && port < 65536) {
+            RangeType temp (0,0);
+            temp.start = port;
+            t = strchr(t, '-');
+
+            if (t && *(++t)) {
+                port = atoi(t);
+
+                if (port > 0 && port < 65536 && port > temp.start) {
+                    temp.end = port+1;
+                } else {
+                    debug(28, 0) ("ACLIntRange::parse: Invalid port range\n");
+                    self_destruct();
+                }
+            } else
+                temp.end = temp.start+1;
+
+            ranges.push_back(temp);
+        } else {
+            debug(28, 0) ("ACLIntRange::parse: Invalid port value\n");
+            self_destruct();
+        }
     }
 }
 
@@ -110,7 +124,7 @@ ACLIntRange::dump ()
         if (element.size() == 1)
             snprintf(buf, sizeof(buf), "%d", element.start);
         else
-            snprintf(buf, sizeof(buf), "%d-%d", element.start, element.end);
+            snprintf(buf, sizeof(buf), "%d-%d", element.start, element.end-1);
 
         wordlistAdd(&W, buf);
     }
-- 
2.47.2