(mynewt-core) 01/03: net/ip/mn_socket: Fix IPv4 address parsing in mn_inet_pton

[ja...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

sjanc pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-core.git

commit 060338375f9d9c4e90d8cc07d3c32c524a8ddbe1
Author: Szymon Janc <sz...@codecoup.pl>
AuthorDate: Sun Oct 25 23:26:19 2026 +0100

    net/ip/mn_socket: Fix IPv4 address parsing in mn_inet_pton
    
    Number of dots was checked before processing each character, so a
    fifth octet was written past the 4 bytes address. Addresses with less
    than 4 octets or with empty octets were accepted as well, leaving
    part of the address unset.
    
    Parse octets into a local buffer, require exactly 4 non-empty octets
    and copy the result only on success.
    
    Assisted-by: Claude:claude-opus-5-5
---
 net/ip/mn_socket/src/mn_socket_aconv.c | 29 +++++++++++++++++++----------
 1 file changed, 19 insertions(+), 10 deletions(-)

diff --git a/net/ip/mn_socket/src/mn_socket_aconv.c b/net/ip/mn_socket/src/mn_socket_aconv.c
index e8e44bc79..4421504f0 100644
--- a/net/ip/mn_socket/src/mn_socket_aconv.c
+++ b/net/ip/mn_socket/src/mn_socket_aconv.c
@@ -211,33 +211,42 @@ int
 mn_inet_pton(int af, const char *src, void *dst)
 {
     const char *ch_src;
-    uint8_t *ch_tgt;
+    uint8_t addr[4];
+    int digits;
     int val;
     int cnt;
     int rc;
 
     if (af == MN_PF_INET) {
         cnt = 0;
-        ch_tgt = dst;
         val = 0;
-        for (ch_src = src; *ch_src; ch_src++) {
-            if (cnt > 4) {
-                return 0;
-            }
+        digits = 0;
+        for (ch_src = src;; ch_src++) {
             if (isdigit((unsigned char)*ch_src)) {
                 val = val * 10 + *ch_src - '0';
                 if (val > 255) {
                     return 0;
                 }
-                *ch_tgt = val;
-            } else if (*ch_src == '.') {
-                ++cnt;
+                digits++;
+            } else if (*ch_src == '.' || *ch_src == '\0') {
+                /* Exactly 4 non-empty octets are expected */
+                if (digits == 0 || cnt == sizeof(addr)) {
+                    return 0;
+                }
+                addr[cnt++] = val;
                 val = 0;
-                ch_tgt++;
+                digits = 0;
+                if (*ch_src == '\0') {
+                    break;
+                }
             } else {
                 return 0;
             }
         }
+        if (cnt != sizeof(addr)) {
+            return 0;
+        }
+        memcpy(dst, addr, sizeof(addr));
         return 1;
     } else {
         rc = mn_inet6_pton(src, dst);