disallow bad filter codes fixes #5879

diff --git a/src/bin/radclient-ng.c b/src/bin/radclient-ng.c
index 6614dea332e2b5ad8c79844c17746356eeb5b0c8..ffbf3aab88448c39d782b765574168850bc531d1 100644 (file)
--- a/src/bin/radclient-ng.c
+++ b/src/bin/radclient-ng.c
@@ -612,18 +612,24 @@ static int radclient_init(TALLOC_CTX *ctx, rc_file_pair_t *files)
 
                        if (filters_done && !packets_done) {
                                REDEBUG("Differing number of packets/filters in %s:%s "
-                                       "(too many requests))", files->packets, files->filters);
+                                       "(too many requests)", files->packets, files->filters);
                                goto error;
                        }
 
                        if (!filters_done && packets_done) {
                                REDEBUG("Differing number of packets/filters in %s:%s "
-                                       "(too many filters))", files->packets, files->filters);
+                                       "(too many filters)", files->packets, files->filters);
                                goto error;
                        }
 
                        vp = fr_pair_find_by_da(&request->filter, NULL, attr_packet_type);
                        if (vp) {
+                               if (!FR_RADIUS_PACKET_CODE_VALID(vp->vp_uint32)) {
+                                       REDEBUG("Invalid filter code %u in %s:%s", vp->vp_uint32,
+                                               files->packets, files->filters);
+                                       goto error;
+                               }
+
                                request->filter_code = vp->vp_uint32;
                                fr_pair_delete(&request->filter, vp);
                        }

diff --git a/src/bin/radclient.c b/src/bin/radclient.c
index 8793b131a01e16bcff3cc795cd1e04b74fec0dab..a9d94bec8dcbb38869afa1016e2baa2844734252 100644 (file)
--- a/src/bin/radclient.c
+++ b/src/bin/radclient.c
@@ -433,13 +433,13 @@ static int coa_init(rc_request_t *parent,
 
                if (*coa_filter_done && !*coa_reply_done) {
                        REDEBUG("Differing number of replies/filters in %s:%s "
-                               "(too many replies))", reply_filename, filter_filename);
+                               "(too many replies)", reply_filename, filter_filename);
                        goto error;
                }
 
                if (!*coa_filter_done && *coa_reply_done) {
                        REDEBUG("Differing number of replies/filters in %s:%s "
-                               "(too many filters))", reply_filename, filter_filename);
+                               "(too many filters)", reply_filename, filter_filename);
                        goto error;
                }
 
@@ -613,6 +613,12 @@ static int radclient_init(TALLOC_CTX *ctx, rc_file_pair_t *files)
 
                        vp = fr_pair_find_by_da(&request->filter, NULL, attr_packet_type);
                        if (vp) {
+                               if (!FR_RADIUS_PACKET_CODE_VALID(vp->vp_uint32)) {
+                                       REDEBUG("Invalid filter code %u in %s:%s", vp->vp_uint32,
+                                               files->packets, files->filters);
+                                       goto error;
+                               }
+
                                request->filter_code = vp->vp_uint32;
                                fr_pair_delete(&request->filter, vp);
                        }