From ebc61fe603e570afa4480f79b92df539b19e615f Mon Sep 17 00:00:00 2001
From: Bram Matthys <syzop@vulnscan.org>
Date: Wed, 29 Jul 2015 18:44:39 +0200
Subject: [PATCH] Reject bans with ASCII < 32. There's no reason to allow
 these..

---
 src/channel.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/channel.c b/src/channel.c
index 7744de731..9f851545f 100644
--- a/src/channel.c
+++ b/src/channel.c
@@ -882,7 +882,7 @@ char *trim_str(char *str, int len)
  */
 char *clean_ban_mask(char *mask, int what, aClient *cptr)
 {
-	char *cp;
+	char *cp, *x;
 	char *user;
 	char *host;
 	Extban *p;
@@ -891,11 +891,16 @@ char *clean_ban_mask(char *mask, int what, aClient *cptr)
 	if (cp)
 		*cp = '\0';
 
-	/* Strip any ':' at beginning coz that desynchs clients/banlists */
+	/* Strip any ':' at beginning since that would cause a desynch */
 	for (; (*mask && (*mask == ':')); mask++);
 	if (!*mask)
 		return NULL;
 
+	/* Forbid ASCII < 32 in all bans */
+	for (x = mask; *x; x++)
+		if (*x < ' ')
+			return NULL;
+
 	/* Extended ban? */
 	if ((*mask == '~') && mask[1] && (mask[2] == ':'))
 	{