From: djm@openbsd.org <djm@openbsd.org>
Date: Tue, 11 Jun 2024 01:22:25 +0000 (+0000)
Subject: upstream: fix off-by-one comparison for PerSourcePenalty
X-Git-Tag: V_9_8_P1~60
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fc4e96b2174d6a894d2033421699d091679baced;p=thirdparty%2Fopenssh-portable.git

upstream: fix off-by-one comparison for PerSourcePenalty

OpenBSD-Commit-ID: af4f5d01c41ef870b23e55655bfbf73474a6c02b
---

diff --git a/srclimit.c b/srclimit.c
index bac8ef667..6b8af4fb1 100644
--- a/srclimit.c
+++ b/srclimit.c
@@ -261,7 +261,7 @@ srclimit_penalty_check_allow(int sock, const char **reason)
 			return 1;
 		}
 	}
-	if (npenalties > (size_t)penalty_cfg.max_sources &&
+	if (npenalties >= (size_t)penalty_cfg.max_sources &&
 	    penalty_cfg.overflow_mode == PER_SOURCE_PENALTY_OVERFLOW_DENY_ALL) {
 		*reason = "too many penalised addresses";
 		return 0;