[NET-306] SubnetUtils.SubnetInfo.isInRange is BRAINDEAD (a.k.a. FUBAR)

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.4
• Fix Version/s: 2.0
• Assignee: Unassigned
• Reporter: Dan Checkoway
• Created: 11/Jan/10 23:43
• Updated: 04/Jun/11 19:24
• Resolved: 07/Mar/11 20:56

Description

org.apache.commons.net.utils.SubnetUtils.SubnetInfo.isInRange() is totally broken. It utterly ignores the fact that integer address values might be, um....negative?!

SubnetUtils subnetUtils = new SubnetUtils("66.249.71.0/24");
SubnetUtils.SubnetInfo subnetInfo = subnetUtils.getInfo();
String ip = "213.139.63.227";
if (subnetInfo.isInRange(ip))

{ System.out.println("YES, " + ip + " is in the range: " + subnetInfo.getCidrSignature()); }

else

{ System.out.println("NO, " + ip + " is not in the range: " + subnetInfo.getCidrSignature()); }

YES, 213.139.63.227 is in the range: 66.249.71.0/24

?!?! WTF !?!?!

This is the culprit in SubnetUtils.java:

private boolean isInRange(int address)

{ return ((address-low()) <= (high()-low())); }

The integer values in the test case above are:

66.249.71.1 = 1123632897
66.249.71.254 = 1123633150
213.139.63.227 = -712294429

So...you can see the issue (I hope). Please fix this by changing isInRange() to check if the given value is truly BETWEEN high and low values.

Thank you!!