chrislim2888 / IP2Location-C-Library

IP2Location C library enables the user to find the country, region, city, coordinates, zip code, time zone, ISP, domain name, connection type, area code, weather station code, weather station name, mobile, usage types, etc that any IP address or hostname originates from.
https://www.ip2location.com
MIT License
61 stars 30 forks source link

Empty records return garbled strings #20

Closed DemonTPx closed 4 years ago

DemonTPx commented 5 years ago

The library may return gabled strings if the record it reads is empty. The easiest way to reproduce is by using the IP-COUNTRY-SAMPLE.BIN sample database from https://www.ip2location.com/development-libraries to query any record above 100.x.x.x.

When it finds the record, it looks for a pointer to a string in the file for the country, but it points to 0. It then just reads some stuff from the beginning of the file and returns it as the country code and country name.

Off course this means that the provided binary file is incorrect (it should probably point to the string -), but it also points out some major flaws in the structure of the database. The fact that it can just point to any position in the file scares me and seems very error prone to me.