port ranges can be ambiguous with hypenated port-names.

specify that ranges must be numeric, and only check for range if
first argument is a digit.
identified by danj, fix suggest by sthen

2 files changed, 7 insertions, 6 deletions

diff --git a/src/usr.bin/nc/nc.1 b/src/usr.bin/nc/nc.1
index 2c84a0972f..b05575df67 100644
--- a/src/usr.bin/nc/nc.1
+++ b/src/usr.bin/nc/nc.1
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: nc.1,v 1.91 2018/09/25 20:05:07 jmc Exp $
+.\"     $OpenBSD: nc.1,v 1.92 2018/12/27 17:22:45 tedu Exp $
 .\"
 .\" Copyright (c) 1996 David Sacerdote
 .\" All rights reserved.
@@ -25,7 +25,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: September 25 2018 $
+.Dd $Mdocdate: December 27 2018 $
 .Dt NC 1
 .Os
 .Sh NAME
@@ -391,8 +391,8 @@ sockets, a destination is required and is the socket path to connect to
 option is given).
 .Pp
 .Ar port
-can be a specified as a numeric port number, or as a service name.
-Ports may be specified in a range of the form
+can be a specified as a numeric port number or as a service name.
+Port ranges may be specified as numeric port numbers of the form
 .Ar nn Ns - Ns Ar mm .
 In general,
 a destination port must be specified,
diff --git a/src/usr.bin/nc/netcat.c b/src/usr.bin/nc/netcat.c
index e0966f1952..adfad2dcd9 100644
--- a/src/usr.bin/nc/netcat.c
+++ b/src/usr.bin/nc/netcat.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: netcat.c,v 1.199 2018/11/29 14:25:06 tedu Exp $ */
+/* $OpenBSD: netcat.c,v 1.200 2018/12/27 17:22:45 tedu Exp $ */
 /*
  * Copyright (c) 2001 Eric Jackson <ericj@monkey.org>
  * Copyright (c) 2015 Bob Beck.  All rights reserved.
@@ -42,6 +42,7 @@
 #include <netinet/ip.h>
 #include <arpa/telnet.h>
 
+#include <ctype.h>
 #include <err.h>
 #include <errno.h>
 #include <limits.h>
@@ -1427,7 +1428,7 @@ build_ports(char *p)
         int hi, lo, cp;
         int x = 0;
 
-        if ((n = strchr(p, '-')) != NULL) {
+        if (isdigit((unsigned char)*p) && (n = strchr(p, '-')) != NULL) {
                 *n = '\0';
                 n++;