瀏覽代碼

fix internal buffer overrun in inet_pton

one stop condition for parsing abbreviated ipv6 addressed was missed,
allowing the internal ip[] buffer to overflow. this patch adds the
missing stop condition and masks the array index so that, in case
there are any remaining stop conditions missing, overflowing the
buffer is not possible.

(cherry picked from commit fc13acc3dcb5b1f215c007f583a63551f6a71363)
Rich Felker 10 年之前
父節點
當前提交
f0a5b139ef
共有 1 個文件被更改,包括 3 次插入2 次删除
  1. 3 2
      src/network/inet_pton.c

+ 3 - 2
src/network/inet_pton.c

@@ -39,14 +39,15 @@ int inet_pton(int af, const char *restrict s, void *restrict a0)
 	for (i=0; ; i++) {
 		if (s[0]==':' && brk<0) {
 			brk=i;
-			ip[i]=0;
+			ip[i&7]=0;
 			if (!*++s) break;
+			if (i==7) return 0;
 			continue;
 		}
 		for (v=j=0; j<4 && (d=hexval(s[j]))>=0; j++)
 			v=16*v+d;
 		if (j==0) return 0;
-		ip[i] = v;
+		ip[i&7] = v;
 		if (!s[j] && (brk>=0 || i==7)) break;
 		if (i==7) return 0;
 		if (s[j]!=':') {