From: Alan T. DeKok <aland@freeradius.org>
Date: Wed, 8 Jul 2026 12:23:10 +0000 (-0400)
Subject: disallow bad filter codes  fixes #5879
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=df1e11bc748e9fe2d8265b4720aeaac7e7fe3c3b;p=thirdparty%2Ffreeradius-server.git

disallow bad filter codes  fixes #5879
---

diff --git a/src/bin/radclient-ng.c b/src/bin/radclient-ng.c
index 6614dea332e..ffbf3aab884 100644
--- a/src/bin/radclient-ng.c
+++ b/src/bin/radclient-ng.c
@@ -612,18 +612,24 @@ static int radclient_init(TALLOC_CTX *ctx, rc_file_pair_t *files)
 
 			if (filters_done && !packets_done) {
 				REDEBUG("Differing number of packets/filters in %s:%s "
-				        "(too many requests))", files->packets, files->filters);
+				        "(too many requests)", files->packets, files->filters);
 				goto error;
 			}
 
 			if (!filters_done && packets_done) {
 				REDEBUG("Differing number of packets/filters in %s:%s "
-				        "(too many filters))", files->packets, files->filters);
+				        "(too many filters)", files->packets, files->filters);
 				goto error;
 			}
 
 			vp = fr_pair_find_by_da(&request->filter, NULL, attr_packet_type);
 			if (vp) {
+				if (!FR_RADIUS_PACKET_CODE_VALID(vp->vp_uint32)) {
+					REDEBUG("Invalid filter code %u in %s:%s", vp->vp_uint32,
+						files->packets, files->filters);
+					goto error;
+				}
+
 				request->filter_code = vp->vp_uint32;
 				fr_pair_delete(&request->filter, vp);
 			}
diff --git a/src/bin/radclient.c b/src/bin/radclient.c
index 8793b131a01..a9d94bec8dc 100644
--- a/src/bin/radclient.c
+++ b/src/bin/radclient.c
@@ -433,13 +433,13 @@ static int coa_init(rc_request_t *parent,
 
 		if (*coa_filter_done && !*coa_reply_done) {
 			REDEBUG("Differing number of replies/filters in %s:%s "
-				"(too many replies))", reply_filename, filter_filename);
+				"(too many replies)", reply_filename, filter_filename);
 			goto error;
 		}
 
 		if (!*coa_filter_done && *coa_reply_done) {
 			REDEBUG("Differing number of replies/filters in %s:%s "
-				"(too many filters))", reply_filename, filter_filename);
+				"(too many filters)", reply_filename, filter_filename);
 			goto error;
 		}
 
@@ -613,6 +613,12 @@ static int radclient_init(TALLOC_CTX *ctx, rc_file_pair_t *files)
 
 			vp = fr_pair_find_by_da(&request->filter, NULL, attr_packet_type);
 			if (vp) {
+				if (!FR_RADIUS_PACKET_CODE_VALID(vp->vp_uint32)) {
+					REDEBUG("Invalid filter code %u in %s:%s", vp->vp_uint32,
+						files->packets, files->filters);
+					goto error;
+				}
+
 				request->filter_code = vp->vp_uint32;
 				fr_pair_delete(&request->filter, vp);
 			}