buglwIP - A Lightweight TCP/IP stack - Bugs: bug #46072, ip4addr_aton() does not check the...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46072: ip4addr_aton() does not check the number range of all address parts

Submitted by:  April M <april_m>
Submitted on:  Tue 29 Sep 2015 06:40:22 AM UTC  
 
Category: DNSSeverity: 3 - Normal
Item Group: Faulty BehaviourStatus: Fixed
Privacy: PublicAssigned to: Simon Goldschmidt <goldsimon>
Open/Closed: ClosedPlanned Release: None
lwIP version: git head

Wed 30 Sep 2015 12:16:06 PM UTC, comment #4:

Also, IPv6 treats IPv6 string such as ":1:2:3:4:5:6:7:8" or ":1:2::3:4:5:6:7" as valid too.
getaddrinfo() RFC takes IPv4 dot string as valid input when the flag AI_NUMERICHOST is set. In my knowledge, x.x.x.x is the right format of IPv4 dot string, in which x is ranging from 0 to 255.

April M <april_m>
Wed 30 Sep 2015 12:16:00 PM UTC, comment #3:

Fixed IPv4, too. Thanks for reporting.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Wed 30 Sep 2015 12:07:46 PM UTC, comment #2:

IPv6 should be fixed.

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Wed 30 Sep 2015 11:50:54 AM UTC, comment #1:

Actually, lwip_getaddrinfo() is not the problem. Instead, I see two problems:

- IPv4: ip4addr_aton() only checks if the last digit is valid, the first digits are not checked
- IPv6: ip6addr_aton() does not reject strings with more than 2 colons in a row

Did I miss anything?

Simon Goldschmidt <goldsimon>
Project AdministratorIn charge of this item.
Tue 29 Sep 2015 06:40:22 AM UTC, original submission:

When using lwip_getaddrinfo() to query strings such as "356.3.4.3" and "1:::1:e:f", it will return 0 indicating successful.

It treats "356.3.4.3" and "1:::1:e:f" as valid ipv4 or ipv6 string, while they are not.

April M <april_m>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by goldsimon (Posted a comment)
  • -unavailable- added by april_m (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 30 Sep 2015 12:16:00 PM UTCgoldsimonStatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
    Wed 30 Sep 2015 12:07:46 PM UTCgoldsimonSummarylwip_getaddrinfo() treats invalid IP string as valid=>ip4addr_aton() does not check the number range of all address parts
    Wed 30 Sep 2015 11:50:54 AM UTCgoldsimonStatusNone=>In Progress
      Assigned toNone=>goldsimon

    Back to the top


    Powered by Savane 3.1-cleanup1