From 81a1f342eb7ecb3c1af9e3d5ccf3e79b241da118 Mon Sep 17 00:00:00 2001
From: kevin9327 <5299031+kevin9327@users.noreply.github.com>
Date: Thu, 12 Nov 2026 11:50:44 +0900
Subject: [PATCH] fix: reject a leading plus in IPv4 octets

Rust's integer parser accepts "+1" as 1, so ipv4_to_decimal and
alt_ipv4_to_decimal treated 192.168.0.+1 as a valid address. Require
each octet to be decimal digits only and add regression tests.
---
 src/conversions/ipv4_conversion.rs | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/conversions/ipv4_conversion.rs b/src/conversions/ipv4_conversion.rs
index b261ba10f9e..2d6d90d834f 100644
--- a/src/conversions/ipv4_conversion.rs
+++ b/src/conversions/ipv4_conversion.rs
@@ -61,6 +61,10 @@ pub fn ipv4_to_decimal(ipv4_address: &str) -> Result<u32, Ipv4Error> {
     let mut decimal_ipv4: u32 = 0;
 
     for octet_str in octets {
+        // Rust's integer parser accepts a leading '+', which is not a valid IPv4 octet.
+        if octet_str.is_empty() || !octet_str.bytes().all(|b| b.is_ascii_digit()) {
+            return Err(Ipv4Error::ParseError);
+        }
         let octet: u32 = octet_str.parse()?;
 
         if octet > 255 {
@@ -97,6 +101,9 @@ pub fn alt_ipv4_to_decimal(ipv4_address: &str) -> Result<u32, Ipv4Error> {
     let hex_string: String = octets
         .iter()
         .map(|octet| {
+            if octet.is_empty() || !octet.bytes().all(|b| b.is_ascii_digit()) {
+                return Err(Ipv4Error::ParseError);
+            }
             let num: u32 = octet.parse().map_err(|_| Ipv4Error::ParseError)?;
             if num > 255 {
                 return Err(Ipv4Error::InvalidOctet(num));
@@ -174,6 +181,9 @@ mod tests {
     fn test_ipv4_to_decimal_parse_error() {
         assert_eq!(ipv4_to_decimal("192.168.0.abc"), Err(Ipv4Error::ParseError));
         assert_eq!(ipv4_to_decimal("a.b.c.d"), Err(Ipv4Error::ParseError));
+        // u32::from_str accepts a leading '+', but IPv4 octets must be digits only.
+        assert_eq!(ipv4_to_decimal("192.168.0.+1"), Err(Ipv4Error::ParseError));
+        assert_eq!(ipv4_to_decimal("192.168.+0.1"), Err(Ipv4Error::ParseError));
     }
 
     #[test]
@@ -194,6 +204,10 @@ mod tests {
             alt_ipv4_to_decimal("10.0.0.256"),
             Err(Ipv4Error::InvalidOctet(256))
         );
+        assert_eq!(
+            alt_ipv4_to_decimal("192.168.0.+1"),
+            Err(Ipv4Error::ParseError)
+        );
     }
 
     #[test]