Add _FORTIFY_SOURCE support for inet_ntop

- Create the __inet_ntop_chk routine that verifies that the builtin size
of the destination buffer is at least as big as the size given by the
user.
- Redirect calls from inet_ntop to __inet_ntop_chk or __inet_ntop_warn
- Update the abilist for this new routine
- Update the manual to mention the new fortification

Reviewed-by: Florian Weimer <fweimer@redhat.com>

46 files changed, 182 insertions, 0 deletions

diff --git a/debug/Makefile b/debug/Makefile
index 6a05205ce6..905f2bf7e0 100644
--- a/debug/Makefile
+++ b/debug/Makefile
@@ -55,6 +55,7 @@ routines = \
   gethostname_chk \
   gets_chk \
   getwd_chk \
+  inet_ntop_chk \
   longjmp_chk \
   mbsnrtowcs_chk \
   mbsrtowcs_chk \
diff --git a/debug/Versions b/debug/Versions
index 9cf2725992..2ae5747f8d 100644
--- a/debug/Versions
+++ b/debug/Versions
@@ -64,6 +64,9 @@ libc {
     __wcslcat_chk;
     __wcslcpy_chk;
   }
+  GLIBC_2.42 {
+    __inet_ntop_chk;
+  }
   GLIBC_PRIVATE {
     __fortify_fail;
   }
diff --git a/debug/inet_ntop_chk.c b/debug/inet_ntop_chk.c
new file mode 100644
index 0000000000..e1ec600fbb
--- /dev/null
+++ b/debug/inet_ntop_chk.c
@@ -0,0 +1,30 @@
+/* Copyright (C) 2025 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <arpa/inet.h>
+#include <stdio.h>
+
+const char *
+__inet_ntop_chk (int af, const void *src, char *dst,
+		 socklen_t size, size_t dst_size)
+{
+  if (size > dst_size)
+    __chk_fail ();
+
+  return __inet_ntop (af, src, dst, size);
+}
+libc_hidden_def (__inet_ntop_chk)
diff --git a/debug/tst-fortify.c b/debug/tst-fortify.c
index f8ccc2dff5..cd649369d9 100644
--- a/debug/tst-fortify.c
+++ b/debug/tst-fortify.c
@@ -23,6 +23,7 @@
 
 #include <assert.h>
 #include <fcntl.h>
+#include <arpa/inet.h>
 #include <limits.h>
 #include <locale.h>
 #include <obstack.h>
@@ -1832,6 +1833,26 @@ do_test (void)
 # endif
 #endif
 
+  struct in6_addr addr6 = {};
+  struct in_addr addr = {};
+  char addrstr6[INET6_ADDRSTRLEN];
+  char addrstr[INET_ADDRSTRLEN];
+
+  if (inet_ntop (AF_INET6, &addr6, addrstr6, sizeof (addrstr6)) == NULL)
+    FAIL ();
+  if (inet_ntop (AF_INET, &addr, addrstr, sizeof (addrstr)) == NULL)
+    FAIL ();
+
+#if __USE_FORTIFY_LEVEL >= 1
+  CHK_FAIL_START
+  inet_ntop (AF_INET6, &addr6, buf, INET6_ADDRSTRLEN);
+  CHK_FAIL_END
+
+  CHK_FAIL_START
+  inet_ntop (AF_INET, &addr, buf, INET_ADDRSTRLEN);
+  CHK_FAIL_END
+#endif
+
   return ret;
 }
 
diff --git a/include/arpa/inet.h b/include/arpa/inet.h
index d9e55a3c7f..a02892f48a 100644
--- a/include/arpa/inet.h
+++ b/include/arpa/inet.h
@@ -3,12 +3,18 @@
 #include <inet/arpa/inet.h>
 
 #ifndef _ISOMAC
+/* Declare functions with security checks.
+   This needs to be included unconditionally as these definition are needed even
+   when fortification is disabled in inet/arpa/inet.h.  */
+#include <bits/inet-fortified-decl.h>
+
 /* Variant of inet_aton which rejects trailing garbage.  */
 extern int __inet_aton_exact (const char *__cp, struct in_addr *__inp);
 libc_hidden_proto (__inet_aton_exact)
 
 extern __typeof (inet_ntop) __inet_ntop;
 libc_hidden_proto (__inet_ntop)
+libc_hidden_proto (__inet_ntop_chk)
 
 libc_hidden_proto (inet_pton)
 extern __typeof (inet_pton) __inet_pton;
diff --git a/include/bits/inet-fortified-decl.h b/include/bits/inet-fortified-decl.h
new file mode 100644
index 0000000000..e6ad4d4663
--- /dev/null
+++ b/include/bits/inet-fortified-decl.h
@@ -0,0 +1 @@
+#include <inet/bits/inet-fortified-decl.h>
diff --git a/include/bits/inet-fortified.h b/include/bits/inet-fortified.h
new file mode 100644
index 0000000000..abba7c5701
--- /dev/null
+++ b/include/bits/inet-fortified.h
@@ -0,0 +1 @@
+#include <inet/bits/inet-fortified.h>
diff --git a/inet/Makefile b/inet/Makefile
index 79bacddfd5..104b5828bf 100644
--- a/inet/Makefile
+++ b/inet/Makefile
@@ -25,6 +25,8 @@ include ../Makeconfig
 headers := \
   $(wildcard arpa/*.h protocols/*.h) \
   bits/in.h \
+  bits/inet-fortified-decl.h \
+  bits/inet-fortified.h \
   ifaddrs.h \
   netinet/ether.h \
   netinet/icmp6.h \
diff --git a/inet/arpa/inet.h b/inet/arpa/inet.h
index 42d38c330d..3083676f5d 100644
--- a/inet/arpa/inet.h
+++ b/inet/arpa/inet.h
@@ -101,6 +101,11 @@ extern char *inet_nsap_ntoa (int __len, const unsigned char *__cp,
 			     char *__buf) __THROW;
 #endif
 
+#if __USE_FORTIFY_LEVEL > 0 && defined __fortify_function
+/* Include functions with security checks.  */
+#  include <bits/inet-fortified.h>
+#endif
+
 __END_DECLS
 
 #endif /* arpa/inet.h */
diff --git a/inet/bits/inet-fortified-decl.h b/inet/bits/inet-fortified-decl.h
new file mode 100644
index 0000000000..23e3cf4b22
--- /dev/null
+++ b/inet/bits/inet-fortified-decl.h
@@ -0,0 +1,35 @@
+/* Declarations of checking macros for inet functions.
+   Copyright (C) 2025 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#ifndef _BITS_INET_FORTIFIED_DEC_H
+#define _BITS_INET_FORTIFIED_DEC_H 1
+
+#ifndef _ARPA_INET_H
+# error "Never include <bits/inet-fortified-decl.h> directly; use <arpa/inet.h> instead."
+#endif
+
+extern const char *__inet_ntop_chk (int, const void *, char *, socklen_t, size_t);
+
+extern const char *__REDIRECT_FORTIFY_NTH (__inet_ntop_alias,
+					   (int, const void *, char *, socklen_t), inet_ntop);
+extern const char *__REDIRECT_NTH (__inet_ntop_chk_warn,
+				   (int, const void *, char *, socklen_t, size_t), __inet_ntop_chk)
+     __warnattr ("inet_ntop called with bigger length than "
+		 "size of destination buffer");
+
+#endif /* bits/inet-fortified-decl.h.  */
diff --git a/inet/bits/inet-fortified.h b/inet/bits/inet-fortified.h
new file mode 100644
index 0000000000..4f6bc34b0f
--- /dev/null
+++ b/inet/bits/inet-fortified.h
@@ -0,0 +1,41 @@
+/* Checking macros for inet functions.
+   Copyright (C) 2025 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#ifndef _BITS_INET_FORTIFIED_H
+#define _BITS_INET_FORTIFIED_H 1
+
+#ifndef _ARPA_INET_H
+# error "Never include <bits/inet-fortified.h> directly; use <arpa/inet.h> instead."
+#endif
+
+#include <bits/inet-fortified-decl.h>
+
+__fortify_function __attribute_overloadable__ const char *
+__NTH (inet_ntop (int __af,
+	   __fortify_clang_overload_arg (const void *, __restrict, __src),
+	   char *__restrict __dst, socklen_t __dst_size))
+    __fortify_clang_warning_only_if_bos_lt (__dst_size, __dst,
+					    "inet_ntop called with bigger length "
+					    "than size of destination buffer")
+{
+  return __glibc_fortify (inet_ntop, __dst_size, sizeof (char),
+			  __glibc_objsize (__dst),
+			  __af, __src, __dst, __dst_size);
+};
+
+#endif /* bits/inet-fortified.h.  */
diff --git a/manual/maint.texi b/manual/maint.texi
index 04faa222e2..ce6a556c68 100644
--- a/manual/maint.texi
+++ b/manual/maint.texi
@@ -303,6 +303,8 @@ The following functions and macros are fortified in @theglibc{}:
 
 @item @code{getwd}
 
+@item @code{inet_ntop}
+
 @item @code{longjmp}
 
 @item @code{mbsnrtowcs}
diff --git a/sysdeps/mach/hurd/i386/libc.abilist b/sysdeps/mach/hurd/i386/libc.abilist
index 461df01ffb..facb01bf8c 100644
--- a/sysdeps/mach/hurd/i386/libc.abilist
+++ b/sysdeps/mach/hurd/i386/libc.abilist
@@ -2584,6 +2584,7 @@ GLIBC_2.41 pthread_mutexattr_setrobust F
 GLIBC_2.41 pthread_mutexattr_setrobust_np F
 GLIBC_2.41 pthread_mutexattr_settype F
 GLIBC_2.41 pthread_sigmask F
+GLIBC_2.42 __inet_ntop_chk F
 GLIBC_2.42 pthread_barrier_destroy F
 GLIBC_2.42 pthread_barrier_init F
 GLIBC_2.42 pthread_barrier_wait F
diff --git a/sysdeps/mach/hurd/x86_64/libc.abilist b/sysdeps/mach/hurd/x86_64/libc.abilist
index 6f235d20ba..3c76f6ae52 100644
--- a/sysdeps/mach/hurd/x86_64/libc.abilist
+++ b/sysdeps/mach/hurd/x86_64/libc.abilist
@@ -2267,6 +2267,7 @@ GLIBC_2.41 pthread_mutexattr_setrobust F
 GLIBC_2.41 pthread_mutexattr_setrobust_np F
 GLIBC_2.41 pthread_mutexattr_settype F
 GLIBC_2.41 pthread_sigmask F
+GLIBC_2.42 __inet_ntop_chk F
 GLIBC_2.42 pthread_barrier_destroy F
 GLIBC_2.42 pthread_barrier_init F
 GLIBC_2.42 pthread_barrier_wait F
diff --git a/sysdeps/unix/sysv/linux/aarch64/libc.abilist b/sysdeps/unix/sysv/linux/aarch64/libc.abilist
index 0889725c79..afbb38fb0e 100644
--- a/sysdeps/unix/sysv/linux/aarch64/libc.abilist
+++ b/sysdeps/unix/sysv/linux/aarch64/libc.abilist
@@ -2750,4 +2750,5 @@ GLIBC_2.39 stdc_trailing_zeros_ull F
 GLIBC_2.39 stdc_trailing_zeros_us F
 GLIBC_2.41 sched_getattr F
 GLIBC_2.41 sched_setattr F
+GLIBC_2.42 __inet_ntop_chk F
 GLIBC_2.42 pthread_gettid_np F
diff --git a/sysdeps/unix/sysv/linux/alpha/libc.abilist b/sysdeps/unix/sysv/linux/alpha/libc.abilist
index b33a52db70..ea11409903 100644
--- a/sysdeps/unix/sysv/linux/alpha/libc.abilist
+++ b/sysdeps/unix/sysv/linux/alpha/libc.abilist
@@ -3097,6 +3097,7 @@ GLIBC_2.4 wprintf F
 GLIBC_2.4 wscanf F
 GLIBC_2.41 sched_getattr F
 GLIBC_2.41 sched_setattr F
+GLIBC_2.4