A deep dive into how glibc's getaddrinfo() accepts IPv4 addresses in wildly unconventional formats — mixed bases (hex/octal/decimal), Unicode digit variants, invisible characters, and odd part counts — all resolving to a legitimate IP. The author demonstrates that any validation relying on superficial string matching of IP addresses can be trivially bypassed.
Background
The article explains that IPv4 addresses are fundamentally 32-bit integers, and the dotted-quad notation is merely a human-readable convention; the underlying parser (inet_aton-style rules from 4.2BSD) interprets each segment independently with auto-detected base, allowing mixed and unusual representations.
- Source
- Lobsters
- Published
- Nov 6, 2026 at 10:47 PM
- Score
- 6.0 / 10