Pushing the Limits with getaddrinfo
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Security researcher acidvegas shows that on Ubuntu 24.04 (glibc 2.39), ping and curl accept IPv4 addresses written with Unicode lookalikes and invisible characters. With AI_IDN set, the name goes through IDNA mapping before the numeric parser, so circled, superscript or segmented digits fold into hex, octal or integer forms of 69.30.206.130. The glibc code ordering was not independently verified. For builders: filters that inspect address strings can be bypassed, so resolve first and check the resulting address.