Re: IP6 bugs in libspf2

Michael Deutschmann <[email protected]> wrote:
>Some serious bugs in libspf2's support for "ip6" mechanisms have come
>to
>my attention.  It was a little tricky to diagnose because the three
>bugs
>interact in ways that make the problems hard to see.
>
>It's relevant to discuss this here rather than some libspf2-specific
>forum, because it means that SPF publishers may want to avoid using the
>ip6 mechanism to avoid spurious fails.
>
>The bugs are in the following function from
>"src/libspf2/spf_compile.c",
>below:
>
>static SPF_errcode_t
>SPF_c_parse_ip6([...])
>{
>	[...]
>	char				 buf[ INET_ADDRSTRLEN ];
>
>	[...
>             at this point start and end are char pointers
>             bracketing the IPv6 address, exclusive of any CIDR size
>        ]
>
>	len =3D end - start;
>	if ( len > sizeof( buf ) - 1 )
>		return SPF_E_INVALID_IP6;
>
>	memcpy( buf, start, len );
>	buf[ len ] =3D '\0';
>	addr =3D SPF_mech_ip6_data(mech);
>	err =3D inet_pton( AF_INET6, buf, addr );
>	if ( err <=3D 0 )
>		return SPF_response_add_error_ptr(spf_response,
>			SPF_E_INVALID_IP6, NULL, buf, NULL);
>
>	return SPF_E_SUCCESS;
>}
>
>The errors are as follows:
>
>1. "buf" is declared as an array of size INET_ADDRSTRLEN, which is
>enough space to write any IPv4 address in ASCII (16 bytes including the
>null terminator).  That is way too small for an IPv6 address.
>INET6_ADDRSTRLEN holds the correct value.  Alone, this bug would cause
>frequent permerrors whenever ip6 mechanisms are used.

Is the fix for this as simple as changing the "buf" size to INET6_ADDRSTR=
LEN?

That would at least reduce the frequency of the second bug, right?

Scott K