From 5f9d66e1a79ce777d4c9daa1b2edd4f9f057efab Mon Sep 17 00:00:00 2001 From: threebeats Date: Mon, 22 Jun 2026 08:22:58 -0400 Subject: [PATCH] fix: reject malformed NNTP OVER ranges instead of returning all articles (#48) parseRange previously returned (0, MaxInt64) for unparseable input, causing OVER/XOVER to deliver the full article overview instead of returning an empty result. Now returns (0, 0) for any parse error. Fixes #45 Co-authored-by: root --- internal/news/nntpd/server.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/internal/news/nntpd/server.go b/internal/news/nntpd/server.go index 4665862..8ac5a50 100644 --- a/internal/news/nntpd/server.go +++ b/internal/news/nntpd/server.go @@ -173,15 +173,17 @@ func parseRange(spec string) (low, high int64) { if len(parts) == 1 { h, err := strconv.ParseInt(parts[0], 10, 64) if err != nil { - h = math.MaxInt64 - return 0, h + return 0, 0 // malformed — empty range instead of all articles } return h, h } - l, _ := strconv.ParseInt(parts[0], 10, 64) + l, err := strconv.ParseInt(parts[0], 10, 64) + if err != nil { + return 0, 0 // malformed — empty range + } h, err := strconv.ParseInt(parts[1], 10, 64) if err != nil { - h = math.MaxInt64 + return 0, 0 // malformed — empty range } return l, h }