Fix buffer overflow reported by cinap_lenrek@gmx.de: "1:2:3:4:5:6:6:255.255.255.255 writes two bytes beyond the ip buffer". Reference: /n/sources/patch/applied/parseip-overflow Date: Wed May 8 12:14:41 CES 2013 Signed-off-by: miller@hamnavoe.com --- /sys/src/libip/parseip.c Wed May 8 12:13:41 2013 +++ /sys/src/libip/parseip.c Wed May 8 12:13:39 2013 @@ -73,7 +73,8 @@ for(i = 0; i < IPaddrlen && ipcharok(*p); i+=2){ op = p; x = strtoul(p, &p, 16); - if(*p == '.' || (*p == 0 && i == 0)){ /* ends with v4? */ + if((*p == '.' && i <= IPaddrlen-4) || (*p == 0 && i == 0)){ + /* ends with v4 */ p = v4parseip(to+i, op); i += 4; break;