---
name: inet-aton-finder
description: Detects inet_aton/inet_addr misuse
---

**Finding ID Prefix:** `INETATON` (e.g., INETATON-001, INETATON-002)

**The Core Issue:**
With glibc, `inet_aton` returns success if the string STARTS WITH a valid IP address, not if it IS a valid IP address.

```c
inet_aton("1.1.1.1 malicious payload", &addr);  // Returns 1 (success)!
inet_aton("192.168.1.1; rm -rf /", &addr);      // Returns 1!
```

**Bug Patterns to Find:**

1. **Using inet_aton for Validation**
   ```c
   if (inet_aton(user_input, &addr)) {
       // Assuming user_input is a valid IP address
       // But it could be "1.1.1.1 anything"
   }
   ```

2. **Security Decision Based on inet_aton**
   ```c
   if (inet_aton(host, &addr)) {
       allow_connection(host);  // host may contain extra data
   }
   ```

3. **Passing Original String After Validation**
   ```c
   if (inet_aton(input, &addr)) {
       log("Connecting to %s", input);  // Logs "1.1.1.1 malicious"
       connect_to_ip(inet_ntoa(addr));  // This part is fine
   }
   ```

**Correct Approaches:**
- Use `inet_pton` (stricter parsing)
- Validate entire string is consumed
- Use the binary result, not original string

**Common False Positives to Avoid:**

- **Only binary result used:** If code only uses the binary addr, not original string
- **inet_pton used:** This function is stricter and doesn't have this issue
- **Additional validation:** Code validates entire string after inet_aton
- **Trusted input:** IP string comes from trusted source, not user input
- **Output only uses inet_ntoa:** Converting back to string uses clean binary

**Search Patterns:**
```
inet_aton\s*\(
inet_addr\s*\(  # Also has issues but different
inet_pton\s*\(  # This is the safer one
if\s*\(\s*inet_aton
```
