From bac0cdbfc3f087a2862cd484a544bc1125bf30a5 Mon Sep 17 00:00:00 2001
From: "Roger A. Light" <roger@atchoo.org>
Date: Sat, 2 Mar 2024 19:44:45 +0000
Subject: [PATCH] Fix oss-fuzz priority issue

---
 plugins/dynamic-security/clients.c | 1 +
 plugins/dynamic-security/groups.c  | 5 +++++
 plugins/dynamic-security/roles.c   | 2 ++
 3 files changed, 8 insertions(+)

diff --git a/plugins/dynamic-security/clients.c b/plugins/dynamic-security/clients.c
index ce75900d..75f570bd 100644
--- a/plugins/dynamic-security/clients.c
+++ b/plugins/dynamic-security/clients.c
@@ -232,6 +232,7 @@ int dynsec_clients__config_load(struct dynsec__data *data, cJSON *tree)
 						if(json_get_string(j_role, "rolename", &rolename, false) == MOSQ_ERR_SUCCESS){
 							json_get_int(j_role, "priority", &priority, true, -1);
 							if(priority > PRIORITY_MAX) priority = PRIORITY_MAX;
+							if(priority < -PRIORITY_MAX) priority = -PRIORITY_MAX;
 							role = dynsec_roles__find(data, rolename);
 							dynsec_rolelist__client_add(client, role, priority);
 						}
diff --git a/plugins/dynamic-security/groups.c b/plugins/dynamic-security/groups.c
index a831043a..2f42be52 100644
--- a/plugins/dynamic-security/groups.c
+++ b/plugins/dynamic-security/groups.c
@@ -127,6 +127,7 @@ int dynsec_groups__process_add_role(struct dynsec__data *data, struct mosquitto_
 	}
 	json_get_int(cmd->j_command, "priority", &priority, true, -1);
 	if(priority > PRIORITY_MAX) priority = PRIORITY_MAX;
+	if(priority < -PRIORITY_MAX) priority = -PRIORITY_MAX;
 
 	group = dynsec_groups__find(data, groupname);
 	if(group == NULL){
@@ -261,6 +262,7 @@ int dynsec_groups__config_load(struct dynsec__data *data, cJSON *tree)
 						if(json_get_string(j_role, "rolename", &rolename, false) == MOSQ_ERR_SUCCESS){
 							json_get_int(j_role, "priority", &priority, true, -1);
 							if(priority > PRIORITY_MAX) priority = PRIORITY_MAX;
+							if(priority < -PRIORITY_MAX) priority = -PRIORITY_MAX;
 							role = dynsec_roles__find(data, rolename);
 							dynsec_rolelist__group_add(group, role, priority);
 						}
@@ -281,6 +283,7 @@ int dynsec_groups__config_load(struct dynsec__data *data, cJSON *tree)
 						if(json_get_string(j_client, "username", &username, false) == MOSQ_ERR_SUCCESS){
 							json_get_int(j_client, "priority", &priority, true, -1);
 							if(priority > PRIORITY_MAX) priority = PRIORITY_MAX;
+							if(priority < -PRIORITY_MAX) priority = -PRIORITY_MAX;
 							dynsec_groups__add_client(data, username, group->groupname, priority, false);
 						}
 					}
@@ -560,6 +563,7 @@ int dynsec_groups__process_add_client(struct dynsec__data *data, struct mosquitt
 
 	json_get_int(cmd->j_command, "priority", &priority, true, -1);
 	if(priority > PRIORITY_MAX) priority = PRIORITY_MAX;
+	if(priority < -PRIORITY_MAX) priority = -PRIORITY_MAX;
 
 	rc = dynsec_groups__add_client(data, username, groupname, priority, true);
 	if(rc == MOSQ_ERR_SUCCESS){
@@ -1017,6 +1021,7 @@ int dynsec_groups__process_modify(struct dynsec__data *data, struct mosquitto_co
 				if(json_get_string(j_client, "username", &username, false) == MOSQ_ERR_SUCCESS){
 					json_get_int(j_client, "priority", &priority, true, -1);
 					if(priority > PRIORITY_MAX) priority = PRIORITY_MAX;
+					if(priority < -PRIORITY_MAX) priority = -PRIORITY_MAX;
 					dynsec_groups__add_client(data, username, groupname, priority, false);
 				}
 			}
diff --git a/plugins/dynamic-security/roles.c b/plugins/dynamic-security/roles.c
index 630e1df9..e0c5e814 100644
--- a/plugins/dynamic-security/roles.c
+++ b/plugins/dynamic-security/roles.c
@@ -237,6 +237,7 @@ static int dynsec_roles__acl_load(cJSON *j_acls, const char *key, struct dynsec_
 
 		json_get_int(j_acl, "priority", &acl->priority, true, 0);
 		if(acl->priority > PRIORITY_MAX) acl->priority = PRIORITY_MAX;
+		if(acl->priority < -PRIORITY_MAX) acl->priority = -PRIORITY_MAX;
 		json_get_bool(j_acl, "allow", &acl->allow, true, false);
 
 		bool allow;
@@ -677,6 +678,7 @@ int dynsec_roles__process_add_acl(struct dynsec__data *data, struct mosquitto_co
 
 	json_get_int(cmd->j_command, "priority", &acl->priority, true, 0);
 	if(acl->priority > PRIORITY_MAX) acl->priority = PRIORITY_MAX;
+	if(acl->priority < -PRIORITY_MAX) acl->priority = -PRIORITY_MAX;
 	json_get_bool(cmd->j_command, "allow", &acl->allow, true, false);
 
 	HASH_ADD_INORDER(hh, *acllist, topic, topic_len, acl, insert_acl_cmp);