From 290380668b40ee8fce7be1039970a769e6eb0ac4 Mon Sep 17 00:00:00 2001
From: Henning Brauer <henning@cvs.openbsd.org>
Date: Mon, 1 Mar 2004 22:58:13 +0000
Subject: make sure AS doesn't exceed upper bound, issue pointed out by Brent
 Graveland <brent@graveland.net>

---
 usr.sbin/bgpd/parse.y | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/usr.sbin/bgpd/parse.y b/usr.sbin/bgpd/parse.y
index e9f20ba2a59..e532266a7b3 100644
--- a/usr.sbin/bgpd/parse.y
+++ b/usr.sbin/bgpd/parse.y
@@ -1,4 +1,4 @@
-/*	$OpenBSD: parse.y,v 1.66 2004/03/01 17:04:07 henning Exp $ */
+/*	$OpenBSD: parse.y,v 1.67 2004/03/01 22:58:12 henning Exp $ */
 
 /*
  * Copyright (c) 2002, 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -111,7 +111,7 @@ typedef struct {
 %token	SET LOCALPREF MED NEXTHOP PREPEND
 %token	ERROR
 %token	<v.string>		STRING
-%type	<v.number>		number optnumber yesno inout
+%type	<v.number>		number asnumber optnumber yesno inout
 %type	<v.string>		string
 %type	<v.addr>		address
 %type	<v.u8>			action quick direction
@@ -142,6 +142,13 @@ number		: STRING			{
 		}
 		;
 
+asnumber	: number			{
+			if ($1 > USHRT_MAX) {
+				yyerror("AS too big: max %u", USHRT_MAX);
+				YYERROR;
+			}
+		}
+
 string		: string STRING				{
 			if (asprintf(&$$, "%s %s", $1, $2) == -1)
 				fatal("string: asprintf");
@@ -169,7 +176,7 @@ varset		: STRING '=' string		{
 		}
 		;
 
-conf_main	: AS number		{
+conf_main	: AS asnumber		{
 			conf->as = $2;
 		}
 		| ROUTERID address		{
@@ -345,7 +352,7 @@ peeroptsl	: peeropts nl
 		| error nl
 		;
 
-peeropts	: REMOTEAS number	{
+peeropts	: REMOTEAS asnumber	{
 			curpeer->conf.remote_as = $2;
 		}
 		| DESCR string		{
-- 
cgit v1.2.3