mirror of
https://github.com/lwip-tcpip/lwip.git
synced 2024-07-04 20:08:57 +00:00
Fix out-of-bound access in ip6addr_ntoa_r()
When detecting that zero is single, code reads the next group even if current group is last group. If next bytes are not-null, last zero is not omitted. If next bytes are null, last zero is omitted, but since there are no groups left, finishing ':' will not be written, resulting in invalid address. This commit turns off non-single zero check for the last group.
This commit is contained in:
parent
f98ca529d4
commit
80e2be17ad
|
@ -270,15 +270,16 @@ ip6addr_ntoa_r(const ip6_addr_t *addr, char *buf, int buflen)
|
||||||
|
|
||||||
/* Check for empty block. */
|
/* Check for empty block. */
|
||||||
if (current_block_value == 0) {
|
if (current_block_value == 0) {
|
||||||
if (current_block_index == 7 && empty_block_flag == 1) {
|
if (current_block_index == 7) {
|
||||||
/* special case, we must render a ':' for the last block. */
|
if (empty_block_flag == 1) {
|
||||||
buf[i++] = ':';
|
/* special case, we must render a ':' for the last block. */
|
||||||
if (i >= buflen) {
|
buf[i++] = ':';
|
||||||
return NULL;
|
if (i >= buflen) {
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
break;
|
||||||
}
|
}
|
||||||
break;
|
} else if (empty_block_flag == 0) {
|
||||||
}
|
|
||||||
if (empty_block_flag == 0) {
|
|
||||||
/* generate empty block "::", but only if more than one contiguous zero block,
|
/* generate empty block "::", but only if more than one contiguous zero block,
|
||||||
* according to current formatting suggestions RFC 5952. */
|
* according to current formatting suggestions RFC 5952. */
|
||||||
next_block_value = lwip_htonl(addr->addr[(current_block_index + 1) >> 1]);
|
next_block_value = lwip_htonl(addr->addr[(current_block_index + 1) >> 1]);
|
||||||
|
|
Loading…
Reference in New Issue
Block a user