kazu-yamamoto / iproute

IP Routing Table in Haskell
http://www.mew.org/~kazu/proj/iproute/
BSD 3-Clause "New" or "Revised" License
47 stars 28 forks source link

IPv4 octet parsing subject to Int overflow #57

Closed TravisCardwell closed 3 years ago

TravisCardwell commented 3 years ago

The dig parser is subject to Int overflow, which causes some invalid strings to parse successfully.

Example:

λ: import Data.IP (IPv4)
λ: print @IPv4 $ read "127.0.0.18446744073709551617"
127.0.0.1

I do not think that this issue is significant, but I figure that I should at least report it.

kazu-yamamoto commented 3 years ago

What is the expected behavior in this case?

TravisCardwell commented 3 years ago

I think that the expected behavior is for the invalid address to fail to parse.

it "does not read overflow IPv4 octets" $ do
    (readMay "127.0.0.18446744073709551617" :: Maybe IPv4) `shouldBe` Nothing

I wrote a fix and discovered that the problematic dig function is used to parse mask lengths as well.

λ: import Data.IP (AddrRange, IPv4)
λ: print @(AddrRange IPv4) $ read "192.168.0.1/18446744073709551648"
192.168.0.1/32

I think that this should fail to parse as well.

it "does not read overflow mask lengths" $ do
    (readMay "192.168.0.1/18446744073709551648" :: Maybe (AddrRange IPv4)) `shouldBe` Nothing

I wrote a fix for this as well.

I will submit my fixes as a PR. If you have any suggestions or requests, please let me know.

kazu-yamamoto commented 3 years ago

I think that the expected behavior is for the invalid address to fail to parse.

This makes sense to me!

kazu-yamamoto commented 3 years ago

Closing.