Virgin import of ntpd 4.2.6p5.

When the series of commits is complete, things like
https://cert.litnet.lt/en/docs/ntp-distributed-reflection-dos-attacks
should be fixed.

PR:		bin/148836 (except that we import a newer version)
Asked by:	Too many
MFC after:	2 weeks

1 files changed, 14 insertions, 12 deletions

diff --git a/libntp/hextoint.c b/libntp/hextoint.c
index 0d774eb..a2e8c043 100644
--- a/libntp/hextoint.c
+++ b/libntp/hextoint.c
@@ -9,7 +9,7 @@
 int
 hextoint(
 	const char *str,
-	u_long *ival
+	u_long *pu
 	)
 {
 	register u_long u;
@@ -18,22 +18,24 @@ hextoint(
 	cp = str;
 
 	if (*cp == '\0')
-	    return 0;
+		return 0;
 
 	u = 0;
 	while (*cp != '\0') {
-		if (!isxdigit((int)*cp))
-		    return 0;
-		if (u >= 0x10000000)
-		    return 0;	/* overflow */
+		if (!isxdigit(*cp))
+			return 0;
+		if (u & 0xF0000000)
+			return 0;	/* overflow */
 		u <<= 4;
-		if (*cp <= '9')		/* very ascii dependent */
-		    u += *cp++ - '0';
-		else if (*cp >= 'a')
-		    u += *cp++ - 'a' + 10;
+		if ('0' <= *cp && *cp <= '9')
+			u += *cp++ - '0';
+		else if ('a' <= *cp && *cp <= 'f')
+			u += *cp++ - 'a' + 10;
+		else if ('A' <= *cp && *cp <= 'F')
+			u += *cp++ - 'A' + 10;
 		else
-		    u += *cp++ - 'A' + 10;
+			return 0;
 	}
-	*ival = u;
+	*pu = u;
 	return 1;
 }