From 70ced4f262e8575347a4a74aefe1c1bee4ae7807 Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Tue, 31 Jan 2023 09:19:34 +0100
Subject: [PATCH] system: let our functions deal with null == '' as they used
 to

There is no point in adding control flow to callers that lead
to the same result in edge cases anyway.

Some parts of the code seem to be abusing ip_in_subnet() but
we can just return false in that case as the IP is not in the
empty subnet.
---
 src/etc/inc/util.inc | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/etc/inc/util.inc b/src/etc/inc/util.inc
index 33283189c..27e8fe895 100644
--- a/src/etc/inc/util.inc
+++ b/src/etc/inc/util.inc
@@ -611,7 +611,7 @@ function is_ipaddrv4($ipaddr)
 /* returns true if $ipaddr is a valid linklocal address (inside fe80::/10) */
 function is_linklocal($ipaddr)
 {
-    return preg_match('/^fe[89ab][0-9a-f]:/i', $ipaddr);
+    return preg_match('/^fe[89ab][0-9a-f]:/i', $ipaddr ?? '');
 }
 
 /* returns true if $ipaddr is a valid literal IPv6 address */
@@ -964,7 +964,7 @@ function exec_safe($format, $args = [])
     }
 
     foreach ($args as $id => $arg) {
-        $args[$id] = escapeshellarg($arg);
+        $args[$id] = escapeshellarg($arg ?? '');
     }
 
     return vsprintf($format, $args);
@@ -1051,7 +1051,9 @@ function ipcmp($a, $b)
 /* return true if $addr is in $subnet, false if not */
 function ip_in_subnet($addr, $subnet)
 {
-    if (is_ipaddrv6($addr)) {
+    if (empty($subnet)) {
+        /* discard invalid input */
+    } elseif (is_ipaddrv6($addr)) {
         return (Net_IPv6::isInNetmask($addr, $subnet));
     } elseif (is_ipaddrv4($addr)) {
         list($ip, $mask) = explode('/', $subnet);