From fc4e96b2174d6a894d2033421699d091679baced Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Tue, 11 Jun 2024 01:22:25 +0000 Subject: [PATCH] upstream: fix off-by-one comparison for PerSourcePenalty OpenBSD-Commit-ID: af4f5d01c41ef870b23e55655bfbf73474a6c02b --- srclimit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/srclimit.c b/srclimit.c index bac8ef667658..6b8af4fb1e77 100644 --- a/srclimit.c +++ b/srclimit.c @@ -261,7 +261,7 @@ srclimit_penalty_check_allow(int sock, const char **reason) return 1; } } - if (npenalties > (size_t)penalty_cfg.max_sources && + if (npenalties >= (size_t)penalty_cfg.max_sources && penalty_cfg.overflow_mode == PER_SOURCE_PENALTY_OVERFLOW_DENY_ALL) { *reason = "too many penalised addresses"; return 0;