2426. [bug] libbind: inet_net_pton() can sometimes return the

                        wrong value if excessively large netmasks are
                        supplied. [RT #18512]

diff --git a/CHANGES b/CHANGES
index a1952df80b89d7a3af47e1dd238295dc34a8447b..77d6cfca8f518edab139900231281d3f960d2df3 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+2426.  [bug]           libbind: inet_net_pton() can sometimes return the
+                       wrong value if excessively large netmasks are
+                       supplied. [RT #18512]
+
 2425.  [bug]           named didn't detect unavailable query source addresses
                        at load time. [RT #18536]
 

diff --git a/lib/bind/inet/inet_net_pton.c b/lib/bind/inet/inet_net_pton.c
index abecfc79cd2c8426da96a0461f3d8633cfd58ee2..6a67379c0e65dc8d2a7d47b56eae004283909b41 100644 (file)
--- a/lib/bind/inet/inet_net_pton.c
+++ b/lib/bind/inet/inet_net_pton.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: inet_net_pton.c,v 1.4.2.1.8.2 2004/03/17 00:29:47 marka Exp $";
+static const char rcsid[] = "$Id: inet_net_pton.c,v 1.4.2.1.8.3 2008/08/26 04:50:32 marka Exp $";
 #endif
 
 #include "port_before.h"
@@ -133,11 +133,11 @@ inet_net_pton_ipv4(const char *src, u_char *dst, size_t size) {
                        INSIST(n >= 0 && n <= 9);
                        bits *= 10;
                        bits += n;
+                       if (bits > 32)
+                               goto enoent;
                } while ((ch = *src++) != '\0' && isascii(ch) && isdigit(ch));
                if (ch != '\0')
                        goto enoent;
-               if (bits > 32)
-                       goto emsgsize;
        }
 
        /* Firey death and destruction unless we prefetched EOS. */