[openssh-commits] [openssh] 03/03: upstream: stricter check for overfull tables in penalty record path

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit e9b6471c59b21e5d9ef1b3832d4bf727338add85
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Thu Jun 20 00:18:05 2024 +0000

    upstream: stricter check for overfull tables in penalty record path
    
    OpenBSD-Commit-ID: 7df01e648a0723418c554e64a9f2b6d38db060a6
---
 srclimit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/srclimit.c b/srclimit.c
index 837e8260..3dbdbf67 100644
--- a/srclimit.c
+++ b/srclimit.c
@@ -405,7 +405,7 @@ srclimit_penalise(struct xaddr *addr, int penalty_type)
 	    penalty_cfg.overflow_mode : penalty_cfg.overflow_mode6;
 	npenaltiesp = addr->af == AF_INET ?  &npenalties4 : &npenalties6;
 	t = addr->af == AF_INET ? "ipv4" : "ipv6";
-	if (*npenaltiesp > (size_t)max_sources &&
+	if (*npenaltiesp >= (size_t)max_sources &&
 	    overflow_mode == PER_SOURCE_PENALTY_OVERFLOW_DENY_ALL) {
 		verbose_f("%s penalty table full, cannot penalise %s for %s", t,
 		    addrnetmask, reason);

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.