- For #1040: adjust error text and disallow negative ports in other

  parts of cfg_mark_ports.

diff --git a/doc/Changelog b/doc/Changelog
index 0b4efc9ff1bbfae41f4f5e009f36ad0fb27d583a..db46a1a8eb43f076b30bef024fd757af200b1b05 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,8 @@
 3 April 2024: Wouter
        - Fix #1040: fix heap-buffer-overflow issue in function cfg_mark_ports
          of file util/config_file.c.
+       - For #1040: adjust error text and disallow negative ports in other
+         parts of cfg_mark_ports.
 
 28 March 2024: Wouter
        - Fix #1034: DoT forward-zone via unbound-control.

diff --git a/util/config_file.c b/util/config_file.c
index e7b2f1959f3637236f50b5a34a6ece99993d6c2b..74554286bbb942b159ed98310d76341c8338afd6 100644 (file)
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -1762,7 +1762,7 @@ cfg_mark_ports(const char* str, int allow, int* avail, int num)
        if(!mid) {
                int port = atoi(str);
                if(port < 0) {
-                       log_err("Prevent out-of-bounds access to array avail");
+                       log_err("port number is negative: %d", port);
                        return 0;
                }
                if(port == 0 && strcmp(str, "0") != 0) {
@@ -1774,6 +1774,10 @@ cfg_mark_ports(const char* str, int allow, int* avail, int num)
        } else {
                int i, low, high = atoi(mid+1);
                char buf[16];
+               if(high < 0) {
+                       log_err("port number is negative: %d", high);
+                       return 0;
+               }
                if(high == 0 && strcmp(mid+1, "0") != 0) {
                        log_err("cannot parse port number '%s'", mid+1);
                        return 0;
@@ -1786,10 +1790,18 @@ cfg_mark_ports(const char* str, int allow, int* avail, int num)
                        memcpy(buf, str, (size_t)(mid-str));
                buf[mid-str] = 0;
                low = atoi(buf);
+               if(low < 0) {
+                       log_err("port number is negative: %d", low);
+                       return 0;
+               }
                if(low == 0 && strcmp(buf, "0") != 0) {
                        log_err("cannot parse port number '%s'", buf);
                        return 0;
                }
+               if(high > num) {
+                       /* Stop very high values from taking a long time. */
+                       high = num;
+               }
                for(i=low; i<=high; i++) {
                        if(i < num)
                                avail[i] = (allow?i:0);