Fixing invalid IPv6 address parsing stack underflow on Windows.
Occurred when parsing an address with more than 7 colons. For example:
1::2:3:4:5:6:7::8
BUG=webrtc:7592
Review-Url: https://codereview.webrtc.org/2867653002
Cr-Commit-Position: refs/heads/master@{#18054}
diff --git a/webrtc/base/win32.cc b/webrtc/base/win32.cc
index 485f7a6..89970ec 100644
--- a/webrtc/base/win32.cc
+++ b/webrtc/base/win32.cc
@@ -276,6 +276,11 @@
++coloncounter;
}
// (coloncount + 1) is the number of shorts left in the address.
+ // If this number is greater than the number of available shorts, the
+ // address is malformed.
+ if (coloncount + 1 > addr_end - addr_cursor) {
+ return 0;
+ }
addr_cursor = addr_end - (coloncount + 1);
seencompressed = true;
}
@@ -285,7 +290,7 @@
} else {
uint16_t word;
int bytesread = 0;
- if (sscanf(readcursor, "%hx%n", &word, &bytesread) != 1) {
+ if (sscanf(readcursor, "%4hx%n", &word, &bytesread) != 1) {
return 0;
} else {
*addr_cursor = HostToNetwork16(word);