Re: Global buffer overflow in parse_ip6_mask()

[Phil Sutter <phil@nwl.cc>]

On Wed, Feb 11, 2026 at 02:08:42PM +0100, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > The reason why the second memset() call may mis-behave is the broken
> > div-round-up in there: It does (bits / 8) + 1 when it should do
> > (bits + 7) / 8 instead. Fixed that, only the p[bits / 8] field access
> > needs to remain conditional:
> > 
> > @@ -364,8 +364,9 @@ static struct in6_addr *parse_ip6_mask(char *mask)
> >         if (bits != 0) {
> >                 char *p = (char *)&maskaddr;
> >                 memset(p, 0xff, bits / 8);
> > -               memset(p + (bits / 8) + 1, 0, (128 - bits) / 8);
> > -               p[bits / 8] = 0xff << (8 - (bits & 7));
> > +               memset(p + (bits + 7) / 8, 0, (128 - bits) / 8);
> > +               if (bits & 7)
> > +                       p[bits / 8] = 0xff << (8 - (bits & 7));
> >                 return &maskaddr;
> >         }
> 
> Phil, would you mind formally submitting this as fix?

DONE, thanks for the reminder.