Fixed in bd4850df648bee9d8e0595b7e1147266e6f55a3e Strict range-checking was added to all app number-parsing. It was mostly already all there (except for, sigh, rand) but range-checking was not done. Now it is. -- Rich Salz, OpenSSL dev team; rsalz at openssl.org