Fix panics in GetCIDRFromIPRange and IntegerToIP on valid inputs

[gaoflow]

GetCIDRFromIPRange and IntegerToIP hard-panic on legitimate net.IP inputs. Both are reachable through the library's own API — net.ParseCIDR and IntegerToIP return 4-byte IPs that feed straight back in.

GetCIDRFromIPRange(net.ParseIP("10.0.0.1").To4(), net.ParseIP("10.0.0.9").To4()) // panic: index out of range [0] with length 0
GetCIDRFromIPRange(net.ParseIP("10.0.0.1"), net.ParseIP("10.0.0.9").To4())       // panic (mixed length)
IntegerToIP(new(big.Int).Lsh(big.NewInt(1), 40), 32)                            // panic: index out of range [-1]

Root cause is one class: an unchecked byte-length / magnitude assumption.

• GetCIDRFromIPRange assumes a 16-byte IP. With a 4-byte or mixed pair, rangeToCIDRs compares a normalized 16-byte spanning IP against the raw 4-byte input, spuriously takes the partition branch, and dereferences an empty slice. The same mismatch makes the initial start > end check wrongly reject valid mixed-length ranges (e.g. a 4-byte start with a 16-byte end). Fixed by normalizing both IPs to 16-byte at the entry point.
• IntegerToIP indexes past the destination when ipInt >= 2^bits. Bounded the copy to the destination width so oversized values wrap (mod 2^bits) instead of panicking; in-range values are unchanged.

Tested: new table tests for 4-byte/mixed/IntegerToIP-output/oversized cases, plus a tiling check that 4-byte, 16-byte and mixed inputs all yield the same aligned, contiguous, non-overlapping CIDR set covering the range exactly (also cross-checked against IpRangeToCIDR). go test ./..., go vet pass.

Note the repo's recent merges look dependency-only, so review may be slow — flagging since this is a DoS-on-valid-input in a tool that processes untrusted ranges.

Summary by CodeRabbit

• Bug Fixes

  • Improved IP range handling across different IPv4 byte representations.
  • Corrected large-integer-to-IP conversion to safely wrap values to the target address size.
  • Added validation for invalid IP values in ranges.

• Tests

  • Expanded coverage for overflow behavior, mixed IPv4 formats, and complete CIDR range coverage.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 475bbcd4-ef38-4ece-a907-991d5646b081

📥 Commits

Reviewing files that changed from the base of the PR and between fc482a3 and c33e1ba.

📒 Files selected for processing (4)

• cidr.go
• cidr_test.go
• ip.go
• ip_test.go

---

Walkthrough

The changes make integer-to-IP conversion safe for oversized values and normalize IP range inputs before CIDR generation. Tests cover overflow wrapping, IPv4 byte-length variations, representation parity, and exact CIDR range coverage.

Changes

IP and CIDR corrections

Layer / File(s)	Summary
Safe integer-to-IP conversion cidr.go, cidr_test.go	IntegerToIP truncates oversized integers to the destination size, with tests for round trips and modulo wrapping.
CIDR range normalization and coverage ip.go, ip_test.go	GetCIDRFromIPRange normalizes inputs to 16-byte form, while tests validate equivalent representations and exact CIDR tiling.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Poem

A rabbit hopped through bytes so wide,
And clipped the overflow to fit inside.
CIDRs tiled the path just right,
Four-byte, sixteen-byte—same delight.
“No gaps!” cried Bun, and thumped with pride.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main fix: preventing panics in GetCIDRFromIPRange and IntegerToIP on valid inputs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}