Skip to content

Fix stack buffer overflow in IPv6 parsing with IPv4 dotted notation#28

Open
rustyconover wants to merge 3 commits into
duckdb:mainfrom
rustyconover:fix/ipv6-buffer-overflow
Open

Fix stack buffer overflow in IPv6 parsing with IPv4 dotted notation#28
rustyconover wants to merge 3 commits into
duckdb:mainfrom
rustyconover:fix/ipv6-buffer-overflow

Conversation

@rustyconover

Copy link
Copy Markdown

Summary

  • When parsing IPv6 addresses containing IPv4 dotted decimal notation (e.g., a:b:c:d:e:f:a:1.2.3.4), the IPv4 portion writes two quibbles into a stack-allocated array of size 8. The loop condition only checks parsed_quibble_count < 8, so if we enter with count=7, the first write at index 7 is valid but the second at index 8 overflows the stack buffer.
  • This causes a crash (SIGABRT) on malformed input. While 7 hex quibbles followed by IPv4 notation is invalid, the parser should reject it gracefully instead of crashing.
  • Fix adds a bounds check (parsed_quibble_count + 2 > IPV6_NUM_QUIBBLE) before writing the two IPv4-derived quibbles, returning an appropriate error message.

Reproduction

LOAD inet;
SELECT 'a:b:c:d:e:f:a:1.2.3.4'::INET;  -- crashes with SIGABRT (exit 134)

Test plan

  • Added test case verifying the malformed input is rejected with statement error
  • Verify a:b:c:d:e:f:1.2.3.4 (6 quibbles + IPv4 = 8 total) still works correctly
  • Verify ::ffff:1.2.3.4 still works correctly

🤖 Generated with Claude Code

samansmink and others added 3 commits October 28, 2025 11:16
…764349a126f53de0728c9f

Apply patches from duckdb/duckdb
When parsing IPv6 addresses containing IPv4 dotted decimal notation
(e.g., 'a:b:c:d:e:f:a:1.2.3.4'), the IPv4 portion writes two quibbles
into the quibbles array. The loop condition only checks
parsed_quibble_count < 8, so if we enter with count=7, the first write
at index 7 is valid but the second at index 8 overflows the stack
buffer.

Add a bounds check before writing the two IPv4-derived quibbles to
ensure parsed_quibble_count + 2 <= IPV6_NUM_QUIBBLE, returning an
error if there is insufficient room.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants