8e5dd9
From 907070918d5e81a515315b395f334e52589fe0fb Mon Sep 17 00:00:00 2001
8e5dd9
From: Guy Harris <guy@alum.mit.edu>
8e5dd9
Date: Wed, 18 Dec 2019 15:06:53 -0800
8e5dd9
Subject: [PATCH] Check for invalid IPv4 addresses.
8e5dd9
8e5dd9
This should fix GitHub issue #893.
8e5dd9
---
8e5dd9
 gencode.c    | 9 ++++++++-
8e5dd9
 nametoaddr.c | 9 ++++++++-
8e5dd9
 2 files changed, 16 insertions(+), 2 deletions(-)
8e5dd9
8e5dd9
diff --git a/gencode.c b/gencode.c
8e5dd9
index bdc35e646..040a55315 100644
8e5dd9
--- a/gencode.c
8e5dd9
+++ b/gencode.c
8e5dd9
@@ -6947,11 +6947,15 @@ gen_mcode(compiler_state_t *cstate, const char *s1, const char *s2,
8e5dd9
 		return (NULL);
8e5dd9
 
8e5dd9
 	nlen = __pcap_atoin(s1, &n);
8e5dd9
+	if (nlen < 0)
8e5dd9
+		bpf_error(cstate, "invalid IPv4 address '%s'", s1);
8e5dd9
 	/* Promote short ipaddr */
8e5dd9
 	n <<= 32 - nlen;
8e5dd9
 
8e5dd9
 	if (s2 != NULL) {
8e5dd9
 		mlen = __pcap_atoin(s2, &m);
8e5dd9
+		if (mlen < 0)
8e5dd9
+			bpf_error(cstate, "invalid IPv4 address '%s'", s2);
8e5dd9
 		/* Promote short ipaddr */
8e5dd9
 		m <<= 32 - mlen;
8e5dd9
 		if ((n & ~m) != 0)
8e5dd9
@@ -7009,8 +7013,11 @@ gen_ncode(compiler_state_t *cstate, const char *s, bpf_u_int32 v, struct qual q)
8e5dd9
 		vlen = __pcap_atodn(s, &v);
8e5dd9
 		if (vlen == 0)
8e5dd9
 			bpf_error(cstate, "malformed decnet address '%s'", s);
8e5dd9
-	} else
8e5dd9
+	} else {
8e5dd9
 		vlen = __pcap_atoin(s, &v);
8e5dd9
+		if (vlen < 0)
8e5dd9
+			bpf_error(cstate, "invalid IPv4 address '%s'", s);
8e5dd9
+	}
8e5dd9
 
8e5dd9
 	switch (q.addr) {
8e5dd9
 
8e5dd9
diff --git a/nametoaddr.c b/nametoaddr.c
8e5dd9
index 53070a285..13bf4c683 100644
8e5dd9
--- a/nametoaddr.c
8e5dd9
+++ b/nametoaddr.c
8e5dd9
@@ -674,8 +674,15 @@ __pcap_atoin(const char *s, bpf_u_int32 *addr)
8e5dd9
 	len = 0;
8e5dd9
 	for (;;) {
8e5dd9
 		n = 0;
8e5dd9
-		while (*s && *s != '.')
8e5dd9
+		while (*s && *s != '.') {
8e5dd9
+			if (n > 25) {
8e5dd9
+				/* The result will be > 255 */
8e5dd9
+				return -1;
8e5dd9
+			}
8e5dd9
 			n = n * 10 + *s++ - '0';
8e5dd9
+		}
8e5dd9
+		if (n > 255)
8e5dd9
+			return -1;
8e5dd9
 		*addr <<= 8;
8e5dd9
 		*addr |= n & 0xff;
8e5dd9
 		len += 8;
8e5dd9