2007-04-30 Jakub Jelinek <jakub@redhat.com>

	[BZ #4439]
	* resolv/inet_ntop.c (inet_ntop4): Take terminating '\0' into
	account in the size check.
	* resolv/tst-inet_ntop.c: New test.
	* resolv/Makefile (tests): Add tst-inet_ntop.

diff --git a/ChangeLog b/ChangeLog
index aa27b270066cd35b2c1944ed07ed951ef215d0fc..afe6ee0510c14625abca28939c18a5d7c07c032a 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2007-04-30  Jakub Jelinek  <jakub@redhat.com>
+
+       [BZ #4439]
+       * resolv/inet_ntop.c (inet_ntop4): Take terminating '\0' into
+       account in the size check.
+       * resolv/tst-inet_ntop.c: New test.
+       * resolv/Makefile (tests): Add tst-inet_ntop.
+
 2007-04-28  Ulrich Drepper  <drepper@redhat.com>
 
        [BZ #4102]

diff --git a/resolv/Makefile b/resolv/Makefile
index f6230da8fbe4b563c6f5a889789338803100bd7c..edbac70c3d638ee4707688c621ab87f1c85893a9 100644 (file)
--- a/resolv/Makefile
+++ b/resolv/Makefile
@@ -32,7 +32,7 @@ distribute := ../conf/portability.h mapv4v6addr.h mapv4v6hostent.h \
 routines := herror inet_addr inet_ntop inet_pton nsap_addr res_init \
            res_hconf res_libc res-state
 
-tests = tst-aton tst-leaks
+tests = tst-aton tst-leaks tst-inet_ntop
 xtests = tst-leaks2
 
 generate := mtrace-tst-leaks tst-leaks.mtrace tst-leaks2.mtrace

diff --git a/resolv/inet_ntop.c b/resolv/inet_ntop.c
index e5553a1d3b364dc991423cd04973bed9e69fa6a4..1222d08bda891aad2e3a90da456471f7455b5424 100644 (file)
--- a/resolv/inet_ntop.c
+++ b/resolv/inet_ntop.c
@@ -96,7 +96,7 @@ inet_ntop4(src, dst, size)
        static const char fmt[] = "%u.%u.%u.%u";
        char tmp[sizeof "255.255.255.255"];
 
-       if (SPRINTF((tmp, fmt, src[0], src[1], src[2], src[3])) > size) {
+       if (SPRINTF((tmp, fmt, src[0], src[1], src[2], src[3])) >= size) {
                __set_errno (ENOSPC);
                return (NULL);
        }

diff --git a/resolv/tst-inet_ntop.c b/resolv/tst-inet_ntop.c
new file mode 100644 (file)
index 0000000..a042c74
--- /dev/null
+++ b/resolv/tst-inet_ntop.c
@@ -0,0 +1,111 @@
+#include <arpa/inet.h>
+#include <errno.h>
+#include <netinet/in.h>
+#include <stdio.h>
+#include <string.h>
+
+int
+main (void)
+{
+  struct in_addr addr4;
+  struct in6_addr addr6;
+  char buf[64];
+  int result = 0;
+
+  addr4.s_addr = 0xe0e0e0e0;
+  addr6.s6_addr16[0] = 0;
+  addr6.s6_addr16[1] = 0;
+  addr6.s6_addr16[2] = 0;
+  addr6.s6_addr16[3] = 0;
+  addr6.s6_addr16[4] = 0;
+  addr6.s6_addr16[5] = 0xffff;
+  addr6.s6_addr32[3] = 0xe0e0e0e0;
+  memset (buf, 'x', sizeof buf);
+
+  if (inet_ntop (AF_INET, &addr4, buf, 15) != NULL)
+    {
+      puts ("1st inet_ntop returned non-NULL");
+      result++;
+    }
+  else if (errno != ENOSPC)
+    {
+      puts ("1st inet_ntop didn't fail with ENOSPC");
+      result++;
+    }
+  if (buf[15] != 'x')
+    {
+      puts ("1st inet_ntop wrote past the end of buffer");
+      result++;
+    }
+
+  if (inet_ntop (AF_INET, &addr4, buf, 16) != buf)
+    {
+      puts ("2nd inet_ntop did not return buf");
+      result++;
+    }
+  if (memcmp (buf, "224.224.224.224\0" "xxxxxxxx", 24) != 0)
+    {
+      puts ("2nd inet_ntop wrote past the end of buffer");
+      result++;
+    }
+
+  if (inet_ntop (AF_INET6, &addr6, buf, 22) != NULL)
+    {
+      puts ("3rd inet_ntop returned non-NULL");
+      result++;
+    }
+  else if (errno != ENOSPC)
+    {
+      puts ("3rd inet_ntop didn't fail with ENOSPC");
+      result++;
+    }
+  if (buf[22] != 'x')
+    {
+      puts ("3rd inet_ntop wrote past the end of buffer");
+      result++;
+    }
+
+  if (inet_ntop (AF_INET6, &addr6, buf, 23) != buf)
+    {
+      puts ("4th inet_ntop did not return buf");
+      result++;
+    }
+  if (memcmp (buf, "::ffff:224.224.224.224\0" "xxxxxxxx", 31) != 0)
+    {
+      puts ("4th inet_ntop wrote past the end of buffer");
+      result++;
+    }
+
+  memset (&addr6.s6_addr, 0xe0, sizeof (addr6.s6_addr));
+
+  if (inet_ntop (AF_INET6, &addr6, buf, 39) != NULL)
+    {
+      puts ("5th inet_ntop returned non-NULL");
+      result++;
+    }
+  else if (errno != ENOSPC)
+    {
+      puts ("5th inet_ntop didn't fail with ENOSPC");
+      result++;
+    }
+  if (buf[39] != 'x')
+    {
+      puts ("5th inet_ntop wrote past the end of buffer");
+      result++;
+    }
+
+  if (inet_ntop (AF_INET6, &addr6, buf, 40) != buf)
+    {
+      puts ("6th inet_ntop did not return buf");
+      result++;
+    }
+  if (memcmp (buf, "e0e0:e0e0:e0e0:e0e0:e0e0:e0e0:e0e0:e0e0\0"
+                  "xxxxxxxx", 48) != 0)
+    {
+      puts ("6th inet_ntop wrote past the end of buffer");
+      result++;
+    }
+
+  
+  return result;
+}