2426. [bug] libbind: inet_net_pton() can sometimes return the

                        wrong value if excessively large netmasks are
                        supplied. [RT #18512]

diff --git a/CHANGES b/CHANGES
index 63d898e1cb4f5db8e9efda912a045774b40f8dc9..c0a40085ed182b809059336daedba9ad674ac902 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+2426.  [bug]           libbind: inet_net_pton() can sometimes return the
+                       wrong value if excessively large netmasks are
+                       supplied. [RT #18512]
+
 2425.  [bug]           named didn't detect unavailable query source addresses
                        at load time. [RT #18536]
 

diff --git a/lib/bind/inet/inet_net_pton.c b/lib/bind/inet/inet_net_pton.c
index 154ff65275df03bf3955393523ea4e7145eb2ff0..0970a937ec938045adf9b7042544db509b603f22 100644 (file)
--- a/lib/bind/inet/inet_net_pton.c
+++ b/lib/bind/inet/inet_net_pton.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: inet_net_pton.c,v 1.8 2005/04/27 04:56:20 sra Exp $";
+static const char rcsid[] = "$Id: inet_net_pton.c,v 1.9 2008/08/26 03:53:04 marka Exp $";
 #endif
 
 #include "port_before.h"
@@ -133,11 +133,11 @@ inet_net_pton_ipv4(const char *src, u_char *dst, size_t size) {
                        INSIST(n >= 0 && n <= 9);
                        bits *= 10;
                        bits += n;
+                       if (bits > 32)
+                               goto enoent;
                } while ((ch = *src++) != '\0' && isascii(ch) && isdigit(ch));
                if (ch != '\0')
                        goto enoent;
-               if (bits > 32)
-                       goto emsgsize;
        }
 
        /* Firey death and destruction unless we prefetched EOS. */