lib: do not leak buffer data

Author: indutny

lib/ip.js

@@ -131,15 +131,16 @@ ip.mask = function(addr, mask) {
 
   var result = new Buffer(Math.max(addr.length, mask.length));
 
+  var i = 0;
   // Same protocol - do bitwise and
   if (addr.length === mask.length) {
-    for (var i = 0; i < addr.length; i++) {
+    for (i = 0; i < addr.length; i++) {
       result[i] = addr[i] & mask[i];
     }
   } else if (mask.length === 4) {
     // IPv6 address and IPv4 mask
     // (Mask low bits)
-    for (var i = 0; i < mask.length; i++) {
+    for (i = 0; i < mask.length; i++) {
       result[i] = addr[addr.length - 4  + i] & mask[i];
     }
   } else {
@@ -151,10 +152,13 @@ ip.mask = function(addr, mask) {
     // ::ffff:ipv4
     result[10] = 0xff;
     result[11] = 0xff;
-    for (var i = 0; i < addr.length; i++) {
+    for (i = 0; i < addr.length; i++) {
       result[i + 12] = addr[i] & mask[i + 12];
     }
+    i = i + 12;
   }
+  for (; i < result.length; i++)
+    result[i] = 0;
 
   return ip.toString(result);
 };

test/api-test.js

@@ -93,6 +93,11 @@ describe('IP library for node.js', function() {
       assert.equal(ip.mask('192.168.1.134', '255.255.255.0'), '192.168.1.0');
       assert.equal(ip.mask('192.168.1.134', '::ffff:ff00'), '::ffff:c0a8:100');
     });
+
+    it('should not leak data', function() {
+      for (var i = 0; i < 10; i++)
+        assert.equal(ip.mask('::1', '0.0.0.0'), '::');
+    });
   });
 
   describe('subnet() method', function() {