cmdline: check size of result buffer to avoid overflow

[libcmdline.git] / src / lib / cmdline_parse_ipaddr.c

diff --git a/src/lib/cmdline_parse_ipaddr.c b/src/lib/cmdline_parse_ipaddr.c
index 2ffbf0c..cb41562 100644 (file)
--- a/src/lib/cmdline_parse_ipaddr.c
+++ b/src/lib/cmdline_parse_ipaddr.c
@@ -108,8 +108,8 @@ struct cmdline_token_ops cmdline_token_ipaddr_ops = {
  * sizeof(int) < 4.  sizeof(int) > 4 is fine; all the world's not a VAX.
  */
 
-static int inet_pton4(const char *src, u_char *dst);
-static int inet_pton6(const char *src, u_char *dst);
+static int inet_pton4(const char *src, unsigned char *dst);
+static int inet_pton6(const char *src, unsigned char *dst);
 
 /* int
  * inet_pton(af, src, dst)
@@ -148,11 +148,11 @@ my_inet_pton(int af, const char *src, void *dst)
  *      Paul Vixie, 1996.
  */
 static int
-inet_pton4(const char *src, u_char *dst)
+inet_pton4(const char *src, unsigned char *dst)
 {
        static const char digits[] = "0123456789";
        int saw_digit, octets, ch;
-       u_char tmp[INADDRSZ], *tp;
+       unsigned char tmp[INADDRSZ], *tp;
 
        saw_digit = 0;
        octets = 0;
@@ -161,7 +161,7 @@ inet_pton4(const char *src, u_char *dst)
                const char *pch;
 
                if ((pch = strchr(digits, ch)) != NULL) {
-                       u_int new = *tp * 10 + (pch - digits);
+                       unsigned int new = *tp * 10 + (pch - digits);
 
                        if (new > 255)
                                return (0);
@@ -170,7 +170,7 @@ inet_pton4(const char *src, u_char *dst)
                                        return (0);
                                saw_digit = 1;
                        }
-                       *tp = new;
+                       *tp = (unsigned char)new;
                } else if (ch == '.' && saw_digit) {
                        if (octets == 4)
                                return (0);
@@ -200,14 +200,14 @@ inet_pton4(const char *src, u_char *dst)
  *      Paul Vixie, 1996.
  */
 static int
-inet_pton6(const char *src, u_char *dst)
+inet_pton6(const char *src, unsigned char *dst)
 {
        static const char xdigits_l[] = "0123456789abcdef",
                xdigits_u[] = "0123456789ABCDEF";
-       u_char tmp[IN6ADDRSZ], *tp, *endp, *colonp;
+       unsigned char tmp[IN6ADDRSZ], *tp, *endp, *colonp;
        const char *xdigits, *curtok;
        int ch, saw_xdigit, count_xdigit;
-       u_int val;
+       unsigned int val;
 
        memset((tp = tmp), '\0', IN6ADDRSZ);
        endp = tp + IN6ADDRSZ;
@@ -247,8 +247,8 @@ inet_pton6(const char *src, u_char *dst)
                        }
                        if (tp + sizeof(int16_t) > endp)
                                return (0);
-                       *tp++ = (u_char) (val >> 8) & 0xff;
-                       *tp++ = (u_char) val & 0xff;
+                       *tp++ = (unsigned char) ((val >> 8) & 0xff);
+                       *tp++ = (unsigned char) (val & 0xff);
                        saw_xdigit = 0;
                        count_xdigit = 0;
                        val = 0;
@@ -266,8 +266,8 @@ inet_pton6(const char *src, u_char *dst)
        if (saw_xdigit) {
                if (tp + sizeof(int16_t) > endp)
                        return (0);
-               *tp++ = (u_char) (val >> 8) & 0xff;
-               *tp++ = (u_char) val & 0xff;
+               *tp++ = (unsigned char) ((val >> 8) & 0xff);
+               *tp++ = (unsigned char) (val & 0xff);
        }
        if (colonp != NULL) {
                /*
@@ -290,7 +290,8 @@ inet_pton6(const char *src, u_char *dst)
 }
 
 int
-cmdline_parse_ipaddr(cmdline_parse_token_hdr_t *tk, const char *buf, void *res)
+cmdline_parse_ipaddr(cmdline_parse_token_hdr_t *tk, const char *buf, void *res,
+                    unsigned ressize)
 {
        struct cmdline_token_ipaddr *tk2 = (struct cmdline_token_ipaddr *)tk;
        unsigned int token_len = 0;
@@ -299,18 +300,14 @@ cmdline_parse_ipaddr(cmdline_parse_token_hdr_t *tk, const char *buf, void *res)
        char *prefix, *prefix_end;
        long prefixlen;
 
-       if (! *buf)
+       if (res && ressize < sizeof(cmdline_ipaddr_t))
                return -1;
 
-       while (!cmdline_isendoftoken(buf[token_len]))
-               token_len++;
-
        /* if token is too big... */
-       if (token_len >= INET6_ADDRSTRLEN+4)
+       token_len = snprintf(ip_str, sizeof(ip_str), "%s", buf);
+       if (token_len >= sizeof(ip_str))
                return -1;
 
-       snprintf(ip_str, token_len+1, "%s", buf);
-
        /* convert the network prefix */
        if (tk2->ipaddr_data.flags & CMDLINE_IPADDR_NETWORK) {
                prefix = strrchr(ip_str, '/');