This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Title: ipaddres.IPv4Network and ipaddress.IPv6Network tuple construction will accept out of valid range prefixlen
Type: behavior Stage: resolved
Components: Library (Lib) Versions: Python 3.8, Python 3.7
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: SilentGhost, methane, niconorsk, pmoody, serhiy.storchaka
Priority: normal Keywords: patch

Created on 2019-05-07 22:53 by niconorsk, last changed 2022-04-11 14:59 by admin. This issue is now closed.

Pull Requests
URL Status Linked Edit
PR 13298 merged niconorsk, 2019-05-13 22:03
PR 13309 merged miss-islington, 2019-05-14 10:33
Messages (6)
msg341839 - (view) Author: Nicolai Moore (niconorsk) * Date: 2019-05-07 22:53
When using the tuple-form of constructing IPv4Network and IPv6Network will accept prefixlen outside of the normal allowed ranges.

>>> import ipaddress
>>> ipaddress.IPv4Network(('', 400))

If given a negative number, it will error but not with a particularly useful error:
>>> x = ipaddress.IPv4Network(('', -1))
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib64/python3.7/", line 1532, in __init__
    self.netmask, self._prefixlen = self._make_netmask(mask)
  File "/usr/lib64/python3.7/", line 1112, in _make_netmask
    netmask = IPv4Address(cls._ip_int_from_prefix(prefixlen))
  File "/usr/lib64/python3.7/", line 444, in _ip_int_from_prefix
    return cls._ALL_ONES ^ (cls._ALL_ONES >> prefixlen)
ValueError: negative shift count

Looking at the code, I think all that is needed is a range check within the respective _make_netmask methods in _BaseV4 and _BaseV6 classes
msg341861 - (view) Author: SilentGhost (SilentGhost) * (Python triager) Date: 2019-05-08 10:22
Would you like to submit a fix, Nicolai?
msg341862 - (view) Author: Nicolai Moore (niconorsk) * Date: 2019-05-08 10:35
I'd be happy too. Would be a first time contribution though, so need to give me some time to figure my way around the process.
msg341863 - (view) Author: SilentGhost (SilentGhost) * (Python triager) Date: 2019-05-08 10:45
There are some guidelines available at
msg342448 - (view) Author: Inada Naoki (methane) * (Python committer) Date: 2019-05-14 10:33
New changeset 5e48e3db6f5a937023e99d89cef8884d22bd8533 by Inada Naoki (Nicolai Moore) in branch 'master':
bpo-36845: validate integer network prefix when constructing IP networks (GH-13298)
msg342449 - (view) Author: Inada Naoki (methane) * (Python committer) Date: 2019-05-14 11:00
New changeset 30cccf084d1560d9e3382e69d828b3be8cdb0286 by Inada Naoki (Miss Islington (bot)) in branch '3.7':
bpo-36845: validate integer network prefix when constructing IP networks (GH-13298)
Date User Action Args
2022-04-11 14:59:14adminsetgithub: 81026
2019-05-14 11:00:45methanesetstatus: open -> closed
resolution: fixed
stage: patch review -> resolved
2019-05-14 11:00:21methanesetmessages: + msg342449
2019-05-14 10:33:15miss-islingtonsetpull_requests: + pull_request13219
2019-05-14 10:33:05methanesetnosy: + methane
messages: + msg342448
2019-05-13 22:03:01niconorsksetkeywords: + patch
stage: needs patch -> patch review
pull_requests: + pull_request13208
2019-05-08 10:45:35SilentGhostsetmessages: + msg341863
2019-05-08 10:35:30niconorsksetmessages: + msg341862
2019-05-08 10:23:30SilentGhostsetnosy: + serhiy.storchaka
2019-05-08 10:22:05SilentGhostsetversions: - Python 3.5, Python 3.6, Python 3.9
nosy: + pmoody, SilentGhost

messages: + msg341861

stage: needs patch
2019-05-07 22:53:58niconorskcreate