From 78f889153167452de4cbced921f6428b3d4f663a Mon Sep 17 00:00:00 2001
From: Szabolcs Nagy <nsz@port70.net>
Date: Wed, 23 Oct 2013 01:49:14 +0000
Subject: fix inet_pton

* parse IPv4 dotted-decimal correctly (without strtoul, no leading zeros)
* disallow single leading ':' in IPv6 address
* allow at most 4 hex digits in IPv6 address (according to RFC 2373)
* have enough hex fields in IPv4 mapped IPv6 address
* disallow leading zeros in IPv4 mapped IPv6 address
---
 src/network/inet_pton.c | 45 +++++++++++++++++++--------------------------
 1 file changed, 19 insertions(+), 26 deletions(-)

(limited to 'src')

diff --git a/src/network/inet_pton.c b/src/network/inet_pton.c
index 8f7c17b5..f840dd44 100644
--- a/src/network/inet_pton.c
+++ b/src/network/inet_pton.c
@@ -1,7 +1,6 @@
 #include <sys/socket.h>
 #include <netdb.h>
 #include <arpa/inet.h>
-#include <stdlib.h>
 #include <ctype.h>
 #include <errno.h>
 #include <string.h>
@@ -18,52 +17,46 @@ int inet_pton(int af, const char *restrict s, void *restrict a0)
 {
 	uint16_t ip[8];
 	unsigned char *a = a0;
-	const char *z;
-	unsigned long x;
 	int i, j, v, d, brk=-1, need_v4=0;
 
-	/* Reimplement this because inet_pton cannot accept special v4 forms */
 	if (af==AF_INET) {
-		for (i=0; i<4 && *s; i++) {
-			a[i] = x = strtoul(s, (char **)&z, 10);
-			if (!isdigit(*s) || z==s || (*z && *z != '.') || x>255)
-				return 0;
-			s=z+1;
+		for (i=0; i<4; i++) {
+			for (v=j=0; j<3 && isdigit(s[j]); j++)
+				v = 10*v + s[j]-'0';
+			if (j==0 || (j>1 && s[0]=='0') || v>255) return 0;
+			a[i] = v;
+			if (s[j]==0 && i==3) return 1;
+			if (s[j]!='.') return 0;
+			s += j+1;
 		}
-		return 1;
+		return 0;
 	} else if (af!=AF_INET6) {
 		errno = EAFNOSUPPORT;
 		return -1;
 	}
 
-	if (s[0]==':' && s[1]==':') s++;
+	if (*s==':' && *++s!=':') return 0;
 
-	for (i=0; ; i++, s+=j+1) {
+	for (i=0; ; i++) {
 		if (s[0]==':' && brk<0) {
 			brk=i;
-			j=0;
 			ip[i]=0;
-			if (!s[1]) break;
+			if (!*++s) break;
 			continue;
 		}
-		if (hexval(s[0])<0) return 0;
-		while (s[0]=='0' && s[1]=='0') s++;
-		for (v=j=0; j<5 && (d=hexval(s[j]))>=0; j++)
+		for (v=j=0; j<4 && (d=hexval(s[j]))>=0; j++)
 			v=16*v+d;
-		if (v > 65535) return 0;
+		if (j==0 || v > 65535) return 0;
 		ip[i] = v;
-		if (!s[j]) {
-			if (brk<0 && i!=7) return 0;
-			break;
-		}
-		if (i<7) {
-			if (s[j]==':') continue;
-			if (s[j]!='.') return 0;
+		if (!s[j] && (brk>=0 || i==7)) break;
+		if (i==7) return 0;
+		if (s[j]!=':') {
+			if (s[j]!='.' || (i<6 && brk<0)) return 0;
 			need_v4=1;
 			i++;
 			break;
 		}
-		return 0;
+		s += j+1;
 	}
 	if (brk>=0) {
 		memmove(ip+brk+7-i, ip+brk, 2*(i+1-brk));
-- 
cgit v1.2.1