From 62ae3df3f3ee7b82a539391b0b3ce17ac3cee4ce Mon Sep 17 00:00:00 2001
From: Dirk Engling <erdgeist@erdgeist.org>
Date: Mon, 26 Oct 2026 21:09:32 +0100
Subject: Make sure to not accept mere prefixes of addresses from query string

---
 ot_http.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'ot_http.c')

diff --git a/ot_http.c b/ot_http.c
index 5e10d59..e1798dc 100644
--- a/ot_http.c
+++ b/ot_http.c
@@ -601,7 +601,7 @@ static ssize_t     http_handle_announce(const int64_t sock, struct ot_workstruct
       char *tmp_buf1 = ws->reply, *tmp_buf2 = ws->reply + 16;
       len           = urlencoded_parse(&read_ptr, tmp_buf2, SCAN_SEARCHPATH_VALUE);
       tmp_buf2[len] = 0;
-      if ((len <= 0) || !ip_parse(tmp_buf2, tmp_buf1))
+      if ((len <= 0) || ip_parse(tmp_buf2, tmp_buf1) != (size_t)len)
         HTTPERROR_400_PARAM;
       OT_SETIP(&ws->peer, tmp_buf1);
     } break;
-- 
cgit v1.3