[gPXE-devel] [PATCH 18/31] [ipv6] verify a valid IPv6 address in inet6_aton

[matthew at theiselins.net]

From: Matthew Iselin <matthew at theiselins.net>

Signed-off-by: Matthew Iselin <matthew at theiselins.net>
---
 src/net/ipv6.c |   23 ++++++++++++++++++++++-
 1 files changed, 22 insertions(+), 1 deletions(-)

diff --git a/src/net/ipv6.c b/src/net/ipv6.c
index 489db44..97665b8 100644
--- a/src/net/ipv6.c
+++ b/src/net/ipv6.c
@@ -499,13 +499,34 @@ char * inet6_ntoa ( struct in6_addr in6 ) {
 int inet6_aton ( const char *cp, struct in6_addr *inp ) {
 	char convbuf[40];
 	char *tmp = convbuf, *next = convbuf;
-	size_t i = 0;
+	size_t i = 0, len = strlen ( cp );
+	int ok;
+	char c;
+	
+	/* Verify a valid address. */
+	if ( ! len ) {
+		return 0;
+	}
+	
+	for ( ; i < len; i++ ) {
+		c = cp[i];
+		
+		ok = c == ':';
+		ok = ok || ( ( c >= '0' ) && ( c <= '9' ) );
+		ok = ok || ( ( c >= 'a' ) && ( c <= 'f' ) );
+		ok = ok || ( ( c >= 'A' ) && ( c <= 'F' ) );
+		
+		if ( ! ok ) {
+			return 0;
+		}
+	}
 	
 	strcpy ( convbuf, cp );
 	
 	DBG ( "ipv6 converting %s to an in6_addr\n", cp );
 	
 	/* Handle the first part of the address (or all of it if no zero-compression. */
+	i = 0;
 	while ( ( next = strchr ( next, ':' ) ) ) {
 		/* Cater for zero-compression. */
 		if ( *tmp == ':' )
-- 
1.7.2.5