php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #79906 FILTER_FLAG_NO_RES_RANGE wrong on short IPv6 addresses
Submitted: 2020-07-28 12:05 UTC Modified: -
From: os at tnys-welt dot de Assigned:
Status: Open Package: Unknown/Other Function
PHP Version: 7.4.8 OS: all
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: os at tnys-welt dot de
New email:
PHP Version: OS:

 

 [2020-07-28 12:05 UTC] os at tnys-welt dot de 
Description:
------------
The flag FILTER_FLAG_NO_RES_RANGE for IPv6 is working internally with strncasecmp and does not take into account, that IPv6 addresses may be shortened by removing leading zeros.

line 900ff of ext/filter/logical_filters.c:
(Z_STRLEN_P(value) >= 9 &&  !strncasecmp("2001:0db8", Z_STRVAL_P(value), 9)) ||
(Z_STRLEN_P(value) >= 2 &&  !strncasecmp("5f", Z_STRVAL_P(value), 2)) ||
(Z_STRLEN_P(value) >= 4 &&  !strncasecmp("3ff3", Z_STRVAL_P(value), 4)) ||
(Z_STRLEN_P(value) >= 8 &&  !strncasecmp("2001:001", Z_STRVAL_P(value), 8))

Test script:
---------------
<?php

var_dump(filter_var('2001:0db8:0000:08d3:0000:8a2e:0070:7344', FILTER_VALIDATE_IP, FILTER_FLAG_NO_RES_RANGE));
var_dump(filter_var('2001:db8:0:8d3:0:8a2e:70:7344', FILTER_VALIDATE_IP, FILTER_FLAG_NO_RES_RANGE));

Expected result:
----------------
bool(false)
bool(false)

Actual result:
--------------
bool(false)
string(29) "2001:db8:0:8d3:0:8a2e:70:7344"

Patches

Add a Patch

Pull Requests

Add a Pull Request
 
PHP Copyright © 2001-2021 The PHP Group
All rights reserved. 		Last updated: Fri Mar 05 20:01:24 2021 UTC