net/netip: allow only valid prefix digits in ParsePrefix

[gostls13.git] / src / net / netip / netip.go

diff --git a/src/net/netip/netip.go b/src/net/netip/netip.go
index 99cb754fae87762b22c42b2014d6989558ee8019..46f466c076b3414d86a875bc9fbefb6daa9857e7 100644 (file)
--- a/src/net/netip/netip.go
+++ b/src/net/netip/netip.go
@@ -1309,6 +1309,12 @@ func ParsePrefix(s string) (Prefix, error) {
        }
 
        bitsStr := s[i+1:]
+
+       // strconv.Atoi accepts a leading sign and leading zeroes, but we don't want that.
+       if len(bitsStr) > 1 && (bitsStr[0] < '1' || bitsStr[0] > '9') {
+               return Prefix{}, errors.New("netip.ParsePrefix(" + strconv.Quote(s) + "): bad bits after slash: " + strconv.Quote(bitsStr))
+       }
+
        bits, err := strconv.Atoi(bitsStr)
        if err != nil {
                return Prefix{}, errors.New("netip.ParsePrefix(" + strconv.Quote(s) + "): bad bits after slash: " + strconv.Quote(bitsStr))