Avoid a stack overflow when presented with a malformed IPv6 Subnet.

[tinc] / src / subnet_parse.c

diff --git a/src/subnet_parse.c b/src/subnet_parse.c
index c54d343..044d6e7 100644 (file)
--- a/src/subnet_parse.c
+++ b/src/subnet_parse.c
@@ -1,6 +1,6 @@
 /*
     subnet_parse.c -- handle subnet parsing
-    Copyright (C) 2000-2012 Guus Sliepen <guus@tinc-vpn.org>,
+    Copyright (C) 2000-2021 Guus Sliepen <guus@tinc-vpn.org>,
                   2000-2005 Ivo Timmermans
 
     This program is free software; you can redistribute it and/or modify
@@ -87,6 +87,17 @@ void maskcpy(void *va, const void *vb, int masklen, int len) {
        }
 }
 
+bool subnetcheck(const subnet_t subnet) {
+       if(((subnet.type == SUBNET_IPV4)
+                       && !maskcheck(&subnet.net.ipv4.address, subnet.net.ipv4.prefixlength, sizeof(subnet.net.ipv4.address)))
+                       || ((subnet.type == SUBNET_IPV6)
+                           && !maskcheck(&subnet.net.ipv6.address, subnet.net.ipv6.prefixlength, sizeof(subnet.net.ipv6.address)))) {
+               return false;
+       }
+
+       return true;
+}
+
 bool maskcheck(const void *va, int masklen, int len) {
        int i;
        const char *a = va;
@@ -175,9 +186,7 @@ static int subnet_compare_ipv6(const subnet_t *a, const subnet_t *b) {
 }
 
 int subnet_compare(const subnet_t *a, const subnet_t *b) {
-       int result;
-
-       result = a->type - b->type;
+       int result = (int)a->type - (int)b->type;
 
        if(result) {
                return result;
@@ -252,7 +261,7 @@ bool str2net(subnet_t *subnet, const char *subnetstr) {
        if(sscanf(str, "%hx:%hx:%hx:%hx:%hx:%hx%n", &x[0], &x[1], &x[2], &x[3], &x[4], &x[5], &consumed) >= 6 && !str[consumed]) {
                /*
                   Normally we should check that each part has two digits to prevent ambiguities.
-                  However, in old tinc versions net2str() will agressively return MAC addresses with one-digit parts,
+                  However, in old tinc versions net2str() will aggressively return MAC addresses with one-digit parts,
                   so we have to accept them otherwise we would be unable to parse ADD_SUBNET messages.
                */
                if(prefixlength >= 0) {
@@ -297,6 +306,11 @@ bool str2net(subnet_t *subnet, const char *subnetstr) {
 
        char *last_colon = strrchr(str, ':');
 
+       /* Check that the last colon is not further than possible in an IPv6 address */
+       if(last_colon >= str + 5 * 8) {
+               return false;
+       }
+
        if(last_colon && sscanf(last_colon, ":%hu.%hu.%hu.%hu%n", &x[0], &x[1], &x[2], &x[3], &consumed) >= 4 && !last_colon[consumed]) {
                /* Dotted quad suffix notation, convert to standard IPv6 notation */
                for(int i = 0; i < 4; i++)
@@ -371,7 +385,7 @@ bool str2net(subnet_t *subnet, const char *subnetstr) {
 
 bool net2str(char *netstr, int len, const subnet_t *subnet) {
        if(!netstr || !subnet) {
-               logger(DEBUG_ALWAYS, LOG_ERR, "net2str() was called with netstr=%p, subnet=%p!", netstr, subnet);
+               logger(DEBUG_ALWAYS, LOG_ERR, "net2str() was called with netstr=%p, subnet=%p!", (void *)netstr, (void *)subnet);
                return false;
        }