FILTER_FLAG_NO_RES_RANGE does not cover whole 127.0.0.0/8 range

Bug #71745

Submitted:

2016-03-08 14:08 UTC

Modified:

2016-07-08 14:34 UTC

Votes:	1
Avg. Score:	3.0 ± 0.0
Reproduced:	0 of 0 (0.0%)

From:

bugs dot php dot net at majkl578 dot cz

Assigned:

jpauli (profile)

Status:

Closed

Package:

Filter related

PHP Version:

7.0.4

OS:

Private report:

CVE-ID:

None

[2016-03-08 14:08 UTC] bugs dot php dot net at majkl578 dot cz

Description:
------------
Although whole 127.0.0.0/8 range is reserved, PHP only (and incorrectly) validates 127.0.0.1/32. I.e. 127.0.0.2 or 127.0.1.1 should be also treated as reserved range, but they are not currently.

Test script:
---------------
var_dump(filter_var('127.0.1.1', FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_NO_RES_RANGE));

Expected result:
----------------
bool(false)

Actual result:
--------------
string(9) "127.0.1.1"

Patches

Pull Requests

Pull requests:

update filter_var filters for ipv4 addresses to reflect rfc6890 (php-src/1954)
Fix for #71745: FILTER_FLAG_NO_RES_RANGE does not cover whole 127.0.0.0/8 (php-src/1794)

History

AllCommentsChangesGit/SVN commitsRelated reports

[2016-07-08 14:34 UTC] jpauli@php.net

-Status: Open +Status: Closed -Assigned To: +Assigned To: jpauli