From e8e2fc46a93c2db394a4946fe9a541a4244eadbe Mon Sep 17 00:00:00 2001 From: "Brandon McGinty (chatgpt)" Date: Mon, 10 Aug 2026 01:11:58 -0400 Subject: [PATCH] Reject overflowing manual ban durations --- admin.go | 5 ++++- admin_test.go | 3 +++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/admin.go b/admin.go index 757f4db..e8e5f1a 100644 --- a/admin.go +++ b/admin.go @@ -896,13 +896,16 @@ func (b *Barnard) addManualBan(text string) { // manualBanDuration validates user input before it reaches the unsigned // protocol duration field. func manualBanDuration(text string) (time.Duration, error) { - minutes, err := strconv.Atoi(text) + minutes, err := strconv.ParseInt(text, 10, 64) if err != nil { return 0, fmt.Errorf("ban minutes must be a number") } if minutes < 0 { return 0, fmt.Errorf("ban minutes must not be negative") } + if minutes > int64((1<<63-1)/time.Minute) { + return 0, fmt.Errorf("ban duration is too long") + } return time.Duration(minutes) * time.Minute, nil } diff --git a/admin_test.go b/admin_test.go index 1415b10..7e1c169 100644 --- a/admin_test.go +++ b/admin_test.go @@ -85,6 +85,9 @@ func TestManualBanDurationRejectsNegativeMinutes(t *testing.T) { if _, err := manualBanDuration("-1"); err == nil { t.Fatal("negative duration was accepted") } + if _, err := manualBanDuration("9223372036854775807"); err == nil { + t.Fatal("overflowing duration was accepted") + } got, err := manualBanDuration("15") if err != nil || got != 15*60*1000000000 { t.Fatalf("got %v, %v", got, err)