From f2e85ab9ee31ecd7b49bdc1904f655c935c539bf Mon Sep 17 00:00:00 2001
From: Eileen Donlon <emdonlo@gmail.com>
Date: Wed, 21 Mar 2012 12:12:38 -0400
Subject: [PATCH] reject rules with an invalid ttl range

---
 src/detect-ttl.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/detect-ttl.c b/src/detect-ttl.c
index 89f890bda9..a83451bbc7 100644
--- a/src/detect-ttl.c
+++ b/src/detect-ttl.c
@@ -219,8 +219,11 @@ DetectTtlData *DetectTtlParse (char *ttlstr) {
                 ttld->ttl1 = (uint8_t) atoi(arg1);
 
                 ttld->ttl2 = (uint8_t) atoi(arg3);
-                SCLogDebug("ttl is %"PRIu8" and %"PRIu8"",ttld->ttl1, ttld->ttl2);
-
+                SCLogDebug("ttl is %"PRIu8" to %"PRIu8"",ttld->ttl1, ttld->ttl2);
+                if (ttld->ttl1 >= ttld->ttl2) {
+                    SCLogError(SC_ERR_INVALID_SIGNATURE, "Invalid ttl range. ");
+                    goto error;
+                }
                 break;
             default:
                 ttld->mode = DETECT_TTL_EQ;