php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Doc Bug #71935 FILTER_FLAG_NO_RES_RANGE is missing 100.64.0.0/10
Submitted: 2016-03-31 23:45 UTC Modified: 2021-08-05 16:28 UTC
Votes:3
Avg. Score:3.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: bbcan177 at gmail dot com Assigned: cmb (profile)
Status: Not a bug Package: Filter related
PHP Version: Irrelevant OS:
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: bbcan177 at gmail dot com
New email:
PHP Version: OS:

 

 [2016-03-31 23:45 UTC] bbcan177 at gmail dot com 
Description:
------------
---
From manual page: http://www.php.net/filter.filters.flags
---

FILTER_FLAG_NO_RES_RANGE  is missing 100.64.0.0/10 in the documentation.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-08-22 12:12 UTC] jame2 at ceh dot ac dot uk 
I think the documentation is missing a lot more IP addresses than given in the original bug report. 127.0.0.1 is the one that caught me out.

The documentation says "Fails validation for the following reserved IPv4 ranges: 0.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24 and 224.0.0.0/4." Compare this with the code for 5.6.25

if (flags & FILTER_FLAG_NO_RES_RANGE) {
  if (
    (ip[0] == 0) ||
    (ip[0] == 10) ||
    (ip[0] == 100 && (ip[1] >= 64 && ip[1] <= 127)) ||
    (ip[0] == 127) ||
    (ip[0] == 169 && ip[1] == 254) ||
    (ip[0] == 172 && (ip[1] >= 16 && ip[1] <= 31)) ||
    (ip[0] == 192 && ip[1] == 0 && ip[2] == 0) ||
    (ip[0] == 192 && ip[1] == 0 && ip[2] == 2) ||
    (ip[0] == 192 && ip[1] == 88 && ip[2] == 99) ||
    (ip[0] == 192 && ip[1] == 168) ||
    (ip[0] == 198 && (ip[1] == 18 || ip[1] == 19)) ||
    (ip[0] == 198 && ip[1] == 51 && ip[2] == 100) ||
    (ip[0] == 203 && ip[1] == 0 && ip[2] == 113) ||
    (ip[0] >= 224 && ip[0] <= 255)
  ) {
    RETURN_VALIDATION_FAILED
  }
}
 [2017-01-28 13:54 UTC] cmb@php.net
-Package: Documentation problem +Package: Filter related
 [2021-08-05 16:28 UTC] cmb@php.net
-Status: Open +Status: Not a bug -Assigned To: +Assigned To: cmb
 [2021-08-05 16:28 UTC] cmb@php.net 
> FILTER_FLAG_NO_RES_RANGE  is missing 100.64.0.0/10 in the
> documentation.

No, it doesn't.  FILTER_FLAG_NO_RES_RANGE only considers addresses
as reserved which are reserved-by-protocol according to RFC 6890.

> Compare this with the code for 5.6.25

That code has long been fixed.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Sat Jul 12 03:01:32 2025 UTC