> + if (port > 65535)
> + packet_disconnect("Requested port is %d is invalid",port);
This still doesn't fix the problem since port is defined as a signed int,
and negative values will pass your check. Of course, their lower 16 bits
may represent a privileged port number.
BTW, it looks like integer overflows and negative number problems are quite
common: sshd, Linux setrlimit(), Linux sysctl() -- any more coming soon? ;)
Signed,
Solar Designer