Bug #73178 [NEW]: FILTER_FLAG_NO_RES_RANGE is defective

From: mlca at tdc dot dk Operating system: CentOS 7.2 PHP version: 7.0.11 Package: Filter related Bug Type: Bug Bug description:FILTER_FLAG_NO_RES_RANGE is defective Description: ------------ Somewhere between PHP 7.0.8 and 7.0.11 FILTER_FLAG_NO_RES_RANGE behaviour has been changed. In PHP 7.0.11 RFC1918 IP addresses are now matched as reserved as well as private. Test script: --------------- <?php $ips = array("172.16.0.0","172.31.255.255","10.0.0.0","10.255.255.255","127.0.0.1", "0.0.0.0","255.255.255.255","239.224.0.0","100.64.0.0","8.8.8.8"); print "PHP version: " . phpversion() . "\n"; foreach ($ips as $ip) { print "$ip\n"; print " is_reserved=" . ((filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_RES_RANGE) === $ip) ? "false\n" : "true\n"); print " is_private=" . ((filter_var($ip, FILTER_VALIDATE_IP ,FILTER_FLAG_NO_PRIV_RANGE) === $ip) ? "false\n" : "true\n"); } Expected result: ---------------- PHP version: 5.6.24 172.16.0.0 is_reserved=false is_private=true 172.31.255.255 is_reserved=false is_private=true 10.0.0.0 is_reserved=false is_private=true 10.255.255.255 is_reserved=false is_private=true 127.0.0.1 is_reserved=true is_private=false 0.0.0.0 is_reserved=true is_private=false 255.255.255.255 is_reserved=true is_private=false 239.224.0.0 is_reserved=true is_private=false 100.64.0.0 is_reserved=true is_private=false 8.8.8.8 is_reserved=false is_private=false PHP version: 7.0.8-0ubuntu0.16.04.2 172.16.0.0 is_reserved=false is_private=true 172.31.255.255 is_reserved=false is_private=true 10.0.0.0 is_reserved=false is_private=true 10.255.255.255 is_reserved=false is_private=true 127.0.0.1 is_reserved=true is_private=false 0.0.0.0 is_reserved=true is_private=false 255.255.255.255 is_reserved=true is_private=false 239.224.0.0 is_reserved=true is_private=false 100.64.0.0 is_reserved=true is_private=false 8.8.8.8 is_reserved=false is_private=false Actual result: -------------- PHP version: 7.0.11 172.16.0.0 is_reserved=true is_private=true 172.31.255.255 is_reserved=true is_private=true 10.0.0.0 is_reserved=true is_private=true 10.255.255.255 is_reserved=true is_private=true 127.0.0.1 is_reserved=true is_private=false 0.0.0.0 is_reserved=true is_private=false 255.255.255.255 is_reserved=true is_private=false 239.224.0.0 is_reserved=true is_private=false 100.64.0.0 is_reserved=true is_private=false 8.8.8.8 is_reserved=false is_private=false -- Edit bug report at https://bugs.php.net/bug.php?id=73178&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=73178&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=73178&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=73178&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=73178&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=73178&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=73178&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=73178&r=needscript Try newer version: https://bugs.php.net/fix.php?id=73178&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=73178&r=support Expected behavior: https://bugs.php.net/fix.php?id=73178&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=73178&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=73178&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=73178&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=73178&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=73178&r=dst IIS Stability: https://bugs.php.net/fix.php?id=73178&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=73178&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=73178&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=73178&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=73178&r=mysqlcfg