From 700e4f850d56426b43846eac69bc4018e4f6cb07 Mon Sep 17 00:00:00 2001 From: 0z5a Date: Fri, 13 Nov 2026 09:01:27 +0100 Subject: [PATCH] Reject multi-character labels in IPAddressV6::fromInverseArpaName fromInverseArpaName checked only that the name has 32 labels and then used the first character of each label, so a label such as "fe" was read as "f": "fe.0.0.(29 more).0.ip6.arpa" returned ::f instead of throwing. In ip6.arpa names each nibble is one label (RFC 3596, section 2.5), and the header documents IPAddressFormatException for input that is not a valid ip6.arpa representation. Throw when a label is not exactly one character. This also avoids reading the first character of an empty label. --- folly/IPAddressV6.cpp | 8 +++++++- folly/test/IPAddressTest.cpp | 13 +++++++++++++ 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/folly/IPAddressV6.cpp b/folly/IPAddressV6.cpp index c32d782adb2..4eb043a096f 100644 --- a/folly/IPAddressV6.cpp +++ b/folly/IPAddressV6.cpp @@ -230,7 +230,13 @@ IPAddressV6 IPAddressV6::fromInverseArpaName(const std::string& arpaname) { size_t pos = 0; int count = 0; for (size_t i = 1; i <= pieces.size(); i++) { - ip[pos] = pieces[pieces.size() - i][0]; + // Each label is a single hex digit; IPAddressV6 checks that it is hex. + auto const label = pieces[pieces.size() - i]; + if (label.size() != 1) { + throw IPAddressFormatException( + fmt::format("Invalid input. Got '{}'", piece)); + } + ip[pos] = label[0]; pos++; count++; // add ':' every 4 chars diff --git a/folly/test/IPAddressTest.cpp b/folly/test/IPAddressTest.cpp index a6ac55739ae..7c46a4a469a 100644 --- a/folly/test/IPAddressTest.cpp +++ b/folly/test/IPAddressTest.cpp @@ -776,6 +776,19 @@ TEST(IPaddress, fromInverseArpaName) { fmt::format( "{}.ip6.arpa", "3.0.0.0.0.0.0.0.0.0.0.0.c.0.0.b.e.c.a.f.e.f.c.1.0.0.0.0.0.2.6.2"))); + // Each label must be exactly one hex digit. + EXPECT_THROW( + IPAddressV6::fromInverseArpaName( + fmt::format( + "{}.ip6.arpa", + "30.0.0.0.0.0.0.0.0.0.0.0.c.0.0.b.e.c.a.f.e.f.c.1.0.0.0.0.0.2.6.2")), + IPAddressFormatException); + EXPECT_THROW( + IPAddressV6::fromInverseArpaName( + fmt::format( + "{}.ip6.arpa", + ".0.0.0.0.0.0.0.0.0.0.0.c.0.0.b.e.c.a.f.e.f.c.1.0.0.0.0.0.2.6.2")), + IPAddressFormatException); } // Test that invalid string values are killed