shithub: riscv

Info  •  Files  •  Log  •  Branches

fix parseip()

addresses like: "1:2:3:4:5:6:7:255.255.255.255" caused parseip
to write beyond the ip buffer.

--- a/sys/src/libip/parseip.c

+++ b/sys/src/libip/parseip.c

@@ -74,6 +74,10 @@

 		op = p;

 		x = strtoul(p, &p, 16);

 		if(*p == '.' || (*p == 0 && i == 0)){	/* ends with v4? */

+			if(i > IPaddrlen-4){

+				memset(to, 0, IPaddrlen);

+				return -1;		/* parse error */

+			}

 			p = v4parseip(to+i, op);

 			i += 4;

 			break;