diff options
| author | Dirk Engling <erdgeist@erdgeist.org> | 2026-10-26 21:09:32 +0100 |
|---|---|---|
| committer | Dirk Engling <erdgeist@erdgeist.org> | 2026-10-26 21:09:32 +0100 |
| commit | 62ae3df3f3ee7b82a539391b0b3ce17ac3cee4ce (patch) | |
| tree | 012a788d332482ab10fa14007923c516577e9082 | |
| parent | 4abfa6ab68c27dfff8f2f2052a4db144148478b4 (diff) | |
Make sure to not accept mere prefixes of addresses from query string
| -rw-r--r-- | ot_http.c | 2 |
1 files changed, 1 insertions, 1 deletions
| @@ -601,7 +601,7 @@ static ssize_t http_handle_announce(const int64_t sock, struct ot_workstruct | |||
| 601 | char *tmp_buf1 = ws->reply, *tmp_buf2 = ws->reply + 16; | 601 | char *tmp_buf1 = ws->reply, *tmp_buf2 = ws->reply + 16; |
| 602 | len = urlencoded_parse(&read_ptr, tmp_buf2, SCAN_SEARCHPATH_VALUE); | 602 | len = urlencoded_parse(&read_ptr, tmp_buf2, SCAN_SEARCHPATH_VALUE); |
| 603 | tmp_buf2[len] = 0; | 603 | tmp_buf2[len] = 0; |
| 604 | if ((len <= 0) || !ip_parse(tmp_buf2, tmp_buf1)) | 604 | if ((len <= 0) || ip_parse(tmp_buf2, tmp_buf1) != (size_t)len) |
| 605 | HTTPERROR_400_PARAM; | 605 | HTTPERROR_400_PARAM; |
| 606 | OT_SETIP(&ws->peer, tmp_buf1); | 606 | OT_SETIP(&ws->peer, tmp_buf1); |
| 607 | } break; | 607 | } break; |
