github-actions[bot] commented on code in PR #68160:
URL: https://github.com/apache/doris/pull/68160#discussion_r4044547494
##########
be/src/exprs/function/function_ip.h:
##########
@@ -442,13 +415,14 @@ ColumnPtr convert_to_ipv6(const StringColumnType&
string_column,
/// If the source IP address is parsable as an IPv4 address, then
transform it into a valid IPv6 address.
/// Keeping it simple by just prefixing `::ffff:` to the IPv4 address
to represent it as a valid IPv6 address.
- size_t string_length = src_next_offset - src_offset;
+ size_t string_length = src.size;
if (string_length != 0) {
- if (try_parse_ipv4(src_value, dummy_result)) {
- strncat(src_ipv4_buf, src_value, sizeof(src_ipv4_buf) -
strlen(src_ipv4_buf) - 1);
- parse_result = parse_ipv6_whole(src_ipv4_buf, res_value);
+ if (try_parse_ipv4(src_value, src_end, dummy_result)) {
+ memcpy(src_ipv4_buf + ipv4_prefix_length, src_value,
string_length);
Review Comment:
[P1] Bound the mapped-IPv4 copy by the parser's accepted length
`try_parse_ipv4` does not actually cap the text at `IPV4_MAX_TEXT_LENGTH`:
the octet loop uses `len <= 3`, so it consumes four-character low-valued octets
such as `0000`. For example, `0000.0000.0000.0` is 16 bytes and passes the
precheck, but this array has only 15 bytes after the 7-byte prefix, so this
copy writes one byte past it (`0000.0000.0000.0000` writes four past it). This
path is used by the `ipv6_string_to_num*` variants/`inet6_aton` and by string
input to `ipv6_cidr_to_range`. Please either make the parser reject overlong
spellings before this copy or size/map according to the parser's actual
accepted length, and add a boundary test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
