Upto some length, such bans could match the exact IP address.
Obtained from: ircd-ratbox (androsyn)
*len++ = '\0';
cidrlen = atoi(len);
- if (cidrlen == 0)
+ if (cidrlen <= 0)
return 0;
#ifdef RB_IPV6
if (strchr(ip, ':') && strchr(ipmask, ':'))
{
+ if (cidrlen > 128)
+ return 0;
+
aftype = AF_INET6;
ipptr = &((struct sockaddr_in6 *)&ipaddr)->sin6_addr;
maskptr = &((struct sockaddr_in6 *)&maskaddr)->sin6_addr;
#endif
if (!strchr(ip, ':') && !strchr(ipmask, ':'))
{
+ if (cidrlen > 32)
+ return 0;
+
aftype = AF_INET;
ipptr = &((struct sockaddr_in *)&ipaddr)->sin_addr;
maskptr = &((struct sockaddr_in *)&maskaddr)->sin_addr;