--- embedaddon/sudo/plugins/sudoers/match_addr.c	2013/07/22 10:46:12	1.1.1.3
+++ embedaddon/sudo/plugins/sudoers/match_addr.c	2014/06/15 16:12:54	1.1.1.4
@@ -50,27 +50,28 @@
 #include "interfaces.h"
 
 static bool
-addr_matches_if(char *n)
+addr_matches_if(const char *n)
 {
     union sudo_in_addr_un addr;
     struct interface *ifp;
 #ifdef HAVE_STRUCT_IN6_ADDR
-    int j;
+    unsigned int j;
 #endif
-    int family;
+    unsigned int family;
     debug_decl(addr_matches_if, SUDO_DEBUG_MATCH)
 
 #ifdef HAVE_STRUCT_IN6_ADDR
-    if (inet_pton(AF_INET6, n, &addr.ip6) > 0) {
+    if (inet_pton(AF_INET6, n, &addr.ip6) == 1) {
 	family = AF_INET6;
     } else
 #endif /* HAVE_STRUCT_IN6_ADDR */
-    {
+    if (inet_pton(AF_INET, n, &addr.ip4) == 1) {
 	family = AF_INET;
-	addr.ip4.s_addr = inet_addr(n);
+    } else {
+	debug_return_bool(false);
     }
 
-    for (ifp = get_interfaces(); ifp != NULL; ifp = ifp->next) {
+    SLIST_FOREACH(ifp, get_interfaces(), entries) {
 	if (ifp->family != family)
 	    continue;
 	switch (family) {
@@ -100,32 +101,43 @@ addr_matches_if(char *n)
 }
 
 static bool
-addr_matches_if_netmask(char *n, char *m)
+addr_matches_if_netmask(const char *n, const char *m)
 {
-    int i;
+    unsigned int i;
     union sudo_in_addr_un addr, mask;
     struct interface *ifp;
 #ifdef HAVE_STRUCT_IN6_ADDR
-    int j;
+    unsigned int j;
 #endif
-    int family;
+    unsigned int family;
+    const char *errstr;
     debug_decl(addr_matches_if, SUDO_DEBUG_MATCH)
 
 #ifdef HAVE_STRUCT_IN6_ADDR
-    if (inet_pton(AF_INET6, n, &addr.ip6) > 0)
+    if (inet_pton(AF_INET6, n, &addr.ip6) == 1)
 	family = AF_INET6;
     else
 #endif /* HAVE_STRUCT_IN6_ADDR */
-    {
+    if (inet_pton(AF_INET, n, &addr.ip4) == 1) {
 	family = AF_INET;
-	addr.ip4.s_addr = inet_addr(n);
+    } else {
+	debug_return_bool(false);
     }
 
     if (family == AF_INET) {
 	if (strchr(m, '.')) {
-	    mask.ip4.s_addr = inet_addr(m);
+	    if (inet_pton(AF_INET, m, &mask.ip4) != 1) {
+		sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
+		    "IPv4 netmask %s: %s", m, "invalid value");
+		debug_return_bool(false);
+	    }
 	} else {
-	    i = atoi(m);
+	    i = strtonum(m, 0, 32, &errstr);
+	    if (errstr != NULL) {
+		sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
+		    "IPv4 netmask %s: %s", m, errstr);
+		debug_return_bool(false);
+	    }
 	    if (i == 0)
 		mask.ip4.s_addr = 0;
 	    else if (i == 32)
@@ -138,8 +150,13 @@ addr_matches_if_netmask(char *n, char *m)
     }
 #ifdef HAVE_STRUCT_IN6_ADDR
     else {
-	if (inet_pton(AF_INET6, m, &mask.ip6) <= 0) {
-	    j = atoi(m);
+	if (inet_pton(AF_INET6, m, &mask.ip6) != 1) {
+	    j = strtonum(m, 0, 128, &errstr);
+	    if (errstr != NULL) {
+		sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
+		    "IPv6 netmask %s: %s", m, errstr);
+		debug_return_bool(false);
+	    }
 	    for (i = 0; i < sizeof(addr.ip6.s6_addr); i++) {
 		if (j < i * 8)
 		    mask.ip6.s6_addr[i] = 0;
@@ -153,7 +170,7 @@ addr_matches_if_netmask(char *n, char *m)
     }
 #endif /* HAVE_STRUCT_IN6_ADDR */
 
-    for (ifp = get_interfaces(); ifp != NULL; ifp = ifp->next) {
+    SLIST_FOREACH(ifp, get_interfaces(), entries) {
 	if (ifp->family != family)
 	    continue;
 	switch (family) {
@@ -185,16 +202,18 @@ bool
 addr_matches(char *n)
 {
     char *m;
-    bool retval;
+    bool rc;
     debug_decl(addr_matches, SUDO_DEBUG_MATCH)
 
     /* If there's an explicit netmask, use it. */
     if ((m = strchr(n, '/'))) {
 	*m++ = '\0';
-	retval = addr_matches_if_netmask(n, m);
+	rc = addr_matches_if_netmask(n, m);
 	*(m - 1) = '/';
     } else
-	retval = addr_matches_if(n);
+	rc = addr_matches_if(n);
 
-    debug_return_bool(retval);
+    sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO,
+	"IP address %s matches local host: %s", n, rc ? "true" : "false");
+    debug_return_bool(rc);
 }