BUG/MINOR: acl: check the presence of an argument to "-u"

In 1.5-dev23, support for specifying an ACL unique ID was added via
commit 3534d881bc ("MINOR: pattern/acl: Each pattern of each acl can
be load with specified id"). It turns out that if the argument is
missing, we read past the end and can segfault.

This can be backported to all versions. Thanks to Zlatko Bratkovic
for reporting this bug.

diff --git a/src/acl.c b/src/acl.c
index f03c065dc62b178427ccd31acb5ff72157e8abb6..7b1990aaf500ca2303bc5662c2c9ab7cde17b9c4 100644 (file)
--- a/src/acl.c
+++ b/src/acl.c
@@ -331,7 +331,7 @@ struct acl_expr *parse_acl_expr(const char **args, char **err, struct arg_list *
                        patflags |= PAT_MF_NO_DNS;
                else if (strcmp(*args, "-u") == 0) {
                        unique_id = strtol(args[1], &error, 10);
-                       if (*error != '\0') {
+                       if (!*args[1] || *error != '\0') {
                                memprintf(err, "the argument of -u must be an integer");
                                goto out_free_expr;
                        }