Improve validation for CIDR masks

fixes #10375

diff --git a/lib/base/utility.cpp b/lib/base/utility.cpp
index 4fabe40a35c38897fc71930a88d407587285a4b4..8be988aaf9cd89e3a8489bf8767339b0469a4cb3 100644 (file)
--- a/lib/base/utility.cpp
+++ b/lib/base/utility.cpp
@@ -181,17 +181,21 @@ static void ParseIpMask(const String& ip, char mask[16], int *bits)
        if (!ParseIp(uip, mask, &proto))
                BOOST_THROW_EXCEPTION(std::invalid_argument("Invalid IP address specified."));
 
-       if (proto == AF_INET)
+       if (proto == AF_INET) {
+               if (*bits > 32 || *bits < 0)
+                       BOOST_THROW_EXCEPTION(std::invalid_argument("Mask must be between 0 and 32 for IPv4 CIDR masks."));
+
                *bits += 96;
+       }
 
        if (slashp == String::NPos)
                *bits = 128;
 
        if (*bits > 128 || *bits < 0)
-               BOOST_THROW_EXCEPTION(std::invalid_argument("Mask must be between 0 and 128."));
+               BOOST_THROW_EXCEPTION(std::invalid_argument("Mask must be between 0 and 128 for IPv6 CIDR masks."));
 
        for (int i = 0; i < 16; i++) {
-               int lbits = *bits - i * 8;
+               int lbits = std::max(0, *bits - i * 8);
 
                if (lbits >= 8)
                        continue;