sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-04-20 17:26:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Validate prefix length bounds in DecodePrefix

Browse Source
This commit is contained in:
Viktor Liu
2026-03-19 14:31:08 +01:00
parent 67fb6be40a
commit 8550765f38
2 changed files with 27 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
shared/netiputil/compact.go
View File

@@ -26,14 +26,22 @@ func DecodePrefix(b []byte) (netip.Prefix, error) {
case 5:
var ip4 [4]byte
copy(ip4[:], b)
return netip.PrefixFrom(netip.AddrFrom4(ip4), int(b[len(b)-1])), nil
bits := int(b[len(b)-1])
if bits > 32 {
return netip.Prefix{}, fmt.Errorf("invalid IPv4 prefix length %d (max 32)", bits)
}
return netip.PrefixFrom(netip.AddrFrom4(ip4), bits), nil
case 17:
var ip6 [16]byte
copy(ip6[:], b)
addr := netip.AddrFrom16(ip6).Unmap()
bits := int(b[len(b)-1])
if addr.Is4() && bits > 32 {
bits = 32
if addr.Is4() {
if bits > 32 {
bits = 32
}
} else if bits > 128 {
return netip.Prefix{}, fmt.Errorf("invalid IPv6 prefix length %d (max 128)", bits)
}
return netip.PrefixFrom(addr, bits), nil
default: