2007-04-30 Jakub Jelinek <jakub@redhat.com>

	[BZ #4439]
	* resolv/inet_ntop.c (inet_ntop4): Take terminating '\0' into
	account in the size check.
	* resolv/tst-inet_ntop.c: New test.
	* resolv/Makefile (tests): Add tst-inet_ntop.

4 files changed, 121 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index aa27b27006..afe6ee0510 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2007-04-30  Jakub Jelinek  <jakub@redhat.com>
+
+	[BZ #4439]
+	* resolv/inet_ntop.c (inet_ntop4): Take terminating '\0' into
+	account in the size check.
+	* resolv/tst-inet_ntop.c: New test.
+	* resolv/Makefile (tests): Add tst-inet_ntop.
+
 2007-04-28  Ulrich Drepper  <drepper@redhat.com>
 
 	[BZ #4102]
diff --git a/resolv/Makefile b/resolv/Makefile
index f6230da8fb..edbac70c3d 100644
--- a/resolv/Makefile
+++ b/resolv/Makefile
@@ -32,7 +32,7 @@ distribute := ../conf/portability.h mapv4v6addr.h mapv4v6hostent.h \
 routines := herror inet_addr inet_ntop inet_pton nsap_addr res_init \
 	    res_hconf res_libc res-state
 
-tests = tst-aton tst-leaks
+tests = tst-aton tst-leaks tst-inet_ntop
 xtests = tst-leaks2
 
 generate := mtrace-tst-leaks tst-leaks.mtrace tst-leaks2.mtrace
diff --git a/resolv/inet_ntop.c b/resolv/inet_ntop.c
index e5553a1d3b..1222d08bda 100644
--- a/resolv/inet_ntop.c
+++ b/resolv/inet_ntop.c
@@ -96,7 +96,7 @@ inet_ntop4(src, dst, size)
 	static const char fmt[] = "%u.%u.%u.%u";
 	char tmp[sizeof "255.255.255.255"];
 
-	if (SPRINTF((tmp, fmt, src[0], src[1], src[2], src[3])) > size) {
+	if (SPRINTF((tmp, fmt, src[0], src[1], src[2], src[3])) >= size) {
 		__set_errno (ENOSPC);
 		return (NULL);
 	}
diff --git a/resolv/tst-inet_ntop.c b/resolv/tst-inet_ntop.c
new file mode 100644
index 0000000000..a042c74c91
--- /dev/null
+++ b/resolv/tst-inet_ntop.c
@@ -0,0 +1,111 @@
+#include <arpa/inet.h>
+#include <errno.h>
+#include <netinet/in.h>
+#include <stdio.h>
+#include <string.h>
+
+int
+main (void)
+{
+  struct in_addr addr4;
+  struct in6_addr addr6;
+  char buf[64];
+  int result = 0;
+
+  addr4.s_addr = 0xe0e0e0e0;
+  addr6.s6_addr16[0] = 0;
+  addr6.s6_addr16[1] = 0;
+  addr6.s6_addr16[2] = 0;
+  addr6.s6_addr16[3] = 0;
+  addr6.s6_addr16[4] = 0;
+  addr6.s6_addr16[5] = 0xffff;
+  addr6.s6_addr32[3] = 0xe0e0e0e0;
+  memset (buf, 'x', sizeof buf);
+
+  if (inet_ntop (AF_INET, &addr4, buf, 15) != NULL)
+    {
+      puts ("1st inet_ntop returned non-NULL");
+      result++;
+    }
+  else if (errno != ENOSPC)
+    {
+      puts ("1st inet_ntop didn't fail with ENOSPC");
+      result++;
+    }
+  if (buf[15] != 'x')
+    {
+      puts ("1st inet_ntop wrote past the end of buffer");
+      result++;
+    }
+
+  if (inet_ntop (AF_INET, &addr4, buf, 16) != buf)
+    {
+      puts ("2nd inet_ntop did not return buf");
+      result++;
+    }
+  if (memcmp (buf, "224.224.224.224\0" "xxxxxxxx", 24) != 0)
+    {
+      puts ("2nd inet_ntop wrote past the end of buffer");
+      result++;
+    }
+
+  if (inet_ntop (AF_INET6, &addr6, buf, 22) != NULL)
+    {
+      puts ("3rd inet_ntop returned non-NULL");
+      result++;
+    }
+  else if (errno != ENOSPC)
+    {
+      puts ("3rd inet_ntop didn't fail with ENOSPC");
+      result++;
+    }
+  if (buf[22] != 'x')
+    {
+      puts ("3rd inet_ntop wrote past the end of buffer");
+      result++;
+    }
+
+  if (inet_ntop (AF_INET6, &addr6, buf, 23) != buf)
+    {
+      puts ("4th inet_ntop did not return buf");
+      result++;
+    }
+  if (memcmp (buf, "::ffff:224.224.224.224\0" "xxxxxxxx", 31) != 0)
+    {
+      puts ("4th inet_ntop wrote past the end of buffer");
+      result++;
+    }
+
+  memset (&addr6.s6_addr, 0xe0, sizeof (addr6.s6_addr));
+
+  if (inet_ntop (AF_INET6, &addr6, buf, 39) != NULL)
+    {
+      puts ("5th inet_ntop returned non-NULL");
+      result++;
+    }
+  else if (errno != ENOSPC)
+    {
+      puts ("5th inet_ntop didn't fail with ENOSPC");
+      result++;
+    }
+  if (buf[39] != 'x')
+    {
+      puts ("5th inet_ntop wrote past the end of buffer");
+      result++;
+    }
+
+  if (inet_ntop (AF_INET6, &addr6, buf, 40) != buf)
+    {
+      puts ("6th inet_ntop did not return buf");
+      result++;
+    }
+  if (memcmp (buf, "e0e0:e0e0:e0e0:e0e0:e0e0:e0e0:e0e0:e0e0\0"
+		   "xxxxxxxx", 48) != 0)
+    {
+      puts ("6th inet_ntop wrote past the end of buffer");
+      result++;
+    }
+
+  
+  return result;
+}