Revision control
++ // Copyright (C) 2021 The Qt Company Ltd.
++ // Copyright (C) 2016 Intel Corporation.
++ // SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
++ // Qt-Security score:critical reason:data-parser
++
++ #include "qipaddress_p.h"
++ #include "private/qlocale_tools_p.h"
++ #include "private/qtools_p.h"
++ #include "qvarlengtharray.h"
++
++ QT_BEGIN_NAMESPACE
++
++ using namespace Qt::StringLiterals;
++
++ namespace QIPAddressUtils {
++
++ static QString number(quint8 val)
++ {
++ QString zero = QStringLiteral("0");
++ return val ? qulltoa(val, 10, zero) : zero;
++ }
++
++ typedef QVarLengthArray<char, 64> Buffer;
++ static const QChar *checkedToAscii(Buffer &buffer, const QChar *begin, const QChar *end)
++ {
++ const auto *const ubegin = reinterpret_cast<const char16_t *>(begin);
++ const auto *const uend = reinterpret_cast<const char16_t *>(end);
++ auto *src = ubegin;
++
++ buffer.resize(uend - ubegin + 1);
++ char *dst = buffer.data();
++
++ while (src != uend) {
++ if (*src >= 0x7f)
++ return reinterpret_cast<const QChar *>(src);
++ *dst++ = *src++;
++ }
++ *dst = '\0';
++ return nullptr;
++ }
++
++ static bool parseIp4Internal(IPv4Address &address, const char *ptr, bool acceptLeadingZero);
++ bool parseIp4(IPv4Address &address, const QChar *begin, const QChar *end)
++ {
++ Q_ASSERT(begin != end);
++ Buffer buffer;
++ if (checkedToAscii(buffer, begin, end))
++ return false;
++
++ const char *ptr = buffer.data();
++ return parseIp4Internal(address, ptr, true);
++ }
++
++ static bool parseIp4Internal(IPv4Address &address, const char *ptr, bool acceptLeadingZero)
++ {
++ address = 0;
++ int dotCount = 0;
++ const char *const stop = ptr + qstrlen(ptr);
++ while (dotCount < 4) {
++ if (!acceptLeadingZero && *ptr == '0' &&
++ ptr[1] != '.' && ptr[1] != '\0')
++ return false;
++
++ auto [ll, used] = qstrntoull(ptr, stop - ptr, 0);
++ const quint32 x = quint32(ll);
++ if (used <= 0 || ll != x)
++ return false;
++
++ if (ptr[used] == '.' || dotCount == 3) {
++ if (x & ~0xff)
++ return false;
++ address <<= 8;
++ } else if (dotCount == 2) {
++ if (x & ~0xffff)
++ return false;
++ address <<= 16;
++ } else if (dotCount == 1) {
++ if (x & ~0xffffff)
++ return false;
++ address <<= 24;
++ }
++ address |= x;
++
++ if (dotCount == 3 || ptr[used] == '\0')
++ return ptr[used] == '\0';
++ if (ptr[used] != '.')
++ return false;
++
++ ++dotCount;
++ ptr += used + 1;
++ }
++ return false;
++ }
++
++ void toString(QString &appendTo, IPv4Address address)
++ {
++ // reconstructing is easy
++ // use the fast operator% that pre-calculates the size
++ appendTo += number(address >> 24) % u'.'
++ % number(address >> 16) % u'.'
++ % number(address >> 8) % u'.'
++ % number(address);
++ }
++
++ /*!
++ \internal
++ \since 5.0
++
++ Parses one IPv6 address from \a begin to \a end and stores the
++ representation in \a address. Returns null if everything was parsed
++ correctly, or the pointer to the first bad character where parsing failed.
++ If the parsing failed for a reason not related to a particular character,
++ returns \a end.
++ */
++ const QChar *parseIp6(IPv6Address &address, const QChar *begin, const QChar *end)
++ {
++ Q_ASSERT(begin != end);
++
++ if (end - begin < 2)
++ return end;
++
++ Buffer buffer;
++ const QChar *ret = checkedToAscii(buffer, begin, end);
++ if (ret)
++ return ret;
++
++ const char *ptr = buffer.data();
++ const char *const stop = ptr + buffer.size();
++
++ // count the colons
++ int colonCount = 0;
++ int dotCount = 0;
++ while (*ptr) {
++ if (*ptr == ':')
++ ++colonCount;
++ if (*ptr == '.')
++ ++dotCount;
++ ++ptr;
++ }
++ // IPv4-in-IPv6 addresses are stricter in what they accept
++ if (dotCount != 0 && dotCount != 3)
++ return end;
++
++ memset(address, 0, sizeof address);
++ if (colonCount == 2 && end - begin == 2) // "::"
++ return nullptr;
++
++ // if there's a double colon ("::"), this is how many zeroes it means
++ int zeroWordsToFill;
++ ptr = buffer.data();
++
++ // there are two cases where 8 colons are allowed: at the ends
++ // so test that before the colon-count test
++ if ((ptr[0] == ':' && ptr[1] == ':') ||
++ (ptr[end - begin - 2] == ':' && ptr[end - begin - 1] == ':')) {
++ zeroWordsToFill = 9 - colonCount;
++ } else if (colonCount < 2 || colonCount > 7) {
++ return end;
++ } else {
++ zeroWordsToFill = 8 - colonCount;
++ }
++ if (dotCount)
++ --zeroWordsToFill;
++
++ int pos = 0;
++ while (pos < 15) {
++ if (*ptr == ':') {
++ // empty field, we hope it's "::"
++ if (zeroWordsToFill < 1)
++ return begin + (ptr - buffer.data());
++ if (pos == 0 || pos == colonCount * 2) {
++ if (ptr[0] == '\0' || ptr[1] != ':')
++ return begin + (ptr - buffer.data());
++ ++ptr;
++ }
++ pos += zeroWordsToFill * 2;
++ zeroWordsToFill = 0;
++ ++ptr;
++ continue;
++ }
++
++ auto [ll, used] = qstrntoull(ptr, stop - ptr, 16);
++ quint16 x = ll;
++
++ // Reject malformed fields:
++ // - failed to parse
++ // - too many hex digits
++ if (used <= 0 || used > 4)
++ return begin + (ptr - buffer.data());
++
++ if (ptr[used] == '.') {
++ // this could be an IPv4 address
++ // it's only valid in the last element
++ if (pos != 12)
++ return begin + (ptr - buffer.data());
++
++ IPv4Address ip4;
++ if (!parseIp4Internal(ip4, ptr, false))
++ return begin + (ptr - buffer.data());
++
++ address[12] = ip4 >> 24;
++ address[13] = ip4 >> 16;
++ address[14] = ip4 >> 8;
++ address[15] = ip4;
++ return nullptr;
++ }
++
++ address[pos++] = x >> 8;
++ address[pos++] = x & 0xff;
++
++ if (ptr[used] == '\0')
++ break;
++ if (ptr[used] != ':')
++ return begin + (used + ptr - buffer.data());
++ ptr += used + 1;
++ }
++ return pos == 16 ? nullptr : end;
++ }
++
++ static inline QChar toHex(uchar c)
++ {
++ return QChar::fromLatin1(QtMiscUtils::toHexLower(c));
++ }
++
++ void toString(QString &appendTo, const IPv6Address address)
++ {
++ // the longest IPv6 address possible is:
++ // "1111:2222:3333:4444:5555:6666:255.255.255.255"
++ // however, this function never generates that. The longest it does
++ // generate without an IPv4 address is:
++ // "1111:2222:3333:4444:5555:6666:7777:8888"
++ // and the longest with an IPv4 address is:
++ // "::ffff:255.255.255.255"
++ static const int Ip6AddressMaxLen = sizeof "1111:2222:3333:4444:5555:6666:7777:8888";
++ static const int Ip6WithIp4AddressMaxLen = sizeof "::ffff:255.255.255.255";
++
++ // check for the special cases
++ const quint64 zeroes[] = { 0, 0 };
++ bool embeddedIp4 = false;
++
++ // we consider embedded IPv4 for:
++ // ::ffff:x.x.x.x
++ // ::x.x.x.y except if the x are 0 too
++ if (memcmp(address, zeroes, 10) == 0) {
++ if (address[10] == 0xff && address[11] == 0xff) {
++ embeddedIp4 = true;
++ } else if (address[10] == 0 && address[11] == 0) {
++ if (address[12] != 0 || address[13] != 0 || address[14] != 0) {
++ embeddedIp4 = true;
++ } else if (address[15] == 0) {
++ appendTo.append("::"_L1);
++ return;
++ }
++ }
++ }
++
++ // QString::reserve doesn't shrink, so it's fine to us
++ appendTo.reserve(appendTo.size() +
++ (embeddedIp4 ? Ip6WithIp4AddressMaxLen : Ip6AddressMaxLen));
++
++ // for finding where to place the "::"
++ int zeroRunLength = 0; // in octets
++ int zeroRunOffset = 0; // in octets
++ for (int i = 0; i < 16; i += 2) {
++ if (address[i] == 0 && address[i + 1] == 0) {
++ // found a zero, scan forward to see how many more there are
++ int j;
++ for (j = i; j < 16; j += 2) {
++ if (address[j] != 0 || address[j+1] != 0)
++ break;
++ }
++
++ if (j - i > zeroRunLength) {
++ zeroRunLength = j - i;
++ zeroRunOffset = i;
++ i = j;
++ }
++ }
++ }
++
++ const QChar colon = u':';
++ if (zeroRunLength < 4)
++ zeroRunOffset = -1;
++ else if (zeroRunOffset == 0)
++ appendTo.append(colon);
++
++ for (int i = 0; i < 16; i += 2) {
++ if (i == zeroRunOffset) {
++ appendTo.append(colon);
++ i += zeroRunLength - 2;
++ continue;
++ }
++
++ if (i == 12 && embeddedIp4) {
++ IPv4Address ip4 = address[12] << 24 |
++ address[13] << 16 |
++ address[14] << 8 |
++ address[15];
++ toString(appendTo, ip4);
++ return;
++ }
++
++ if (address[i]) {
++ if (address[i] >> 4) {
++ appendTo.append(toHex(address[i] >> 4));
++ appendTo.append(toHex(address[i] & 0xf));
++ appendTo.append(toHex(address[i + 1] >> 4));
++ appendTo.append(toHex(address[i + 1] & 0xf));
++ } else if (address[i] & 0xf) {
++ appendTo.append(toHex(address[i] & 0xf));
++ appendTo.append(toHex(address[i + 1] >> 4));
++ appendTo.append(toHex(address[i + 1] & 0xf));
++ }
++ } else if (address[i + 1] >> 4) {
++ appendTo.append(toHex(address[i + 1] >> 4));
++ appendTo.append(toHex(address[i + 1] & 0xf));
++ } else {
++ appendTo.append(toHex(address[i + 1] & 0xf));
++ }
++
++ if (i != 14)
++ appendTo.append(colon);
++ }
++ }
++
++ }
++ QT_END_NAMESPACE