From cd438d0452d9d3097551671af8d3d2f576b5bbc3 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Tue, 22 Oct 2024 21:17:24 +0200 Subject: [PATCH] Limit CIDR values to avoid possible out-of-bounds when building the netmask Signed-off-by: DL6ER --- src/database/sqlite3-ext.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/database/sqlite3-ext.c b/src/database/sqlite3-ext.c index d572ffb6..c337f93b 100644 --- a/src/database/sqlite3-ext.c +++ b/src/database/sqlite3-ext.c @@ -79,6 +79,14 @@ static void subnet_match_impl(sqlite3_context *context, int argc, sqlite3_value char *addrDB = NULL; const int rt = sscanf(addrDBcidr, "%m[^/]/%i", &addrDB, &cidr); + // Limit CIDR to valid values + if(cidr < 0 || cidr > (isIPv6_DB ? 128 : 32)) + { + log_err("SQL: Invalid CIDR value %d in database entry: %s", cidr, addrDBcidr); + sqlite3_result_int(context, 0); + return; + } + // Skip if database row seems to be a CIDR but does not contain an address ('/32' is invalid) // Passing an invalid IP address to inet_pton() causes a SEGFAULT if(rt < 1 || addrDB == NULL)