{"action":"created","issue":{"url":"https://api.github.com/repos/maxmind/geoip-api-c/issues/70","labels_url":"https://api.github.com/repos/maxmind/geoip-api-c/issues/70/labels{/name}","comments_url":"https://api.github.com/repos/maxmind/geoip-api-c/issues/70/comments","events_url":"https://api.github.com/repos/maxmind/geoip-api-c/issues/70/events","html_url":"https://github.com/maxmind/geoip-api-c/issues/70","id":117265717,"number":70,"title":"Handling extra long entries.","user":{"login":"eternia478","id":3374089,"avatar_url":"https://avatars.githubusercontent.com/u/3374089?v=3","gravatar_id":"","url":"https://api.github.com/users/eternia478","html_url":"https://github.com/eternia478","followers_url":"https://api.github.com/users/eternia478/followers","following_url":"https://api.github.com/users/eternia478/following{/other_user}","gists_url":"https://api.github.com/users/eternia478/gists{/gist_id}","starred_url":"https://api.github.com/users/eternia478/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eternia478/subscriptions","organizations_url":"https://api.github.com/users/eternia478/orgs","repos_url":"https://api.github.com/users/eternia478/repos","events_url":"https://api.github.com/users/eternia478/events{/privacy}","received_events_url":"https://api.github.com/users/eternia478/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-11-17T02:18:14Z","updated_at":"2015-12-07T16:09:17Z","closed_at":"2015-12-07T16:09:16Z","body":"Recently I have been trying to get coordinates from a lot of IP addresses using the Geo Lite Legacy City database found [here](http://dev.maxmind.com/geoip/legacy/geolite/). While using the latest version created on November 3rd, 2015, I found that 79.22.183.0 has a weird property. If I use GEOIP_MEMORY_CACHE, then the coordinates would return (42.233299, 13.983300) for (latitude, longitude). But if I use GEOIP_STANDARD, then the coordinates would return (42.233299, -176.071106) instead.\r\n\r\nTo note, I actually found this issue due to playing around with a third-party pure Python implementation called [pygeoip](https://github.com/appliedsec/pygeoip). When this IP came up, the entire thing threw an exception because the index of reading exceeded the buffer. If I extended this buffer to read more than [FULL_RECORD_LENGTH](https://github.com/maxmind/geoip-api-c/blob/master/libGeoIP/GeoIPCity.c#L59) = 50, then I would get the longitude of 13.983300. Not reading an extra bit and instead continuing further would get me a longitude of -176.071106.\r\n\r\nAs for why I found this to create inconsistent state in the [C library](https://github.com/maxmind/geoip-api-c), I was looking into the [source code](https://github.com/maxmind/geoip-api-c/blob/master/libGeoIP/GeoIPCity.c) and found that actually, the code was more or less the same as that of pygeoip. There were two differences, both which caused this not to throw, say, a segmentation fault or whatever error with the C library (and consequentially the Maxmind official [python](https://github.com/maxmind/geoip-api-python) implementation relying on it):\r\n\r\n1. If GEOIP_MEMORY_CACHE is set, the buffer pointer simply points to the location in memory where the entry is set. This means reading a long entry is possible even if the limit is supposed to be defined as 50. In this case, it read an extra byte \"\\x1d\", I think.\r\n2. If the database is not fully in memory (i.e. GEOIP_STANDARD is set), then what follows the loaded entry in the memory buffer is either zeros or garbage. Because of how C is, allocating with malloc and reading slightly past the intended length without a segfault is possible in some cases. Given the circumstances, I suspect it read an extra \"\\x00.\"\r\n\r\nGiven that the city is San Valentino In Abruzzo Citeriore, Italy, the former (reading then \\x1d and getting 13.98 as a longitude) is actually correct. I suspect that because the city name was so long, it extended the entry past 50 characters and forced the longitude to be encoded in bytes 49-51. But this is somewhat weird. Isn't Maxmind's data format set so that the entry should be 50, as noted above? If anything, shouldn't the entry be limited so that, say, the city name is curtailed and the rest of the entry fits in the length of 50? Or is this some issue with the C implementation such that we should anticipate > length 50?"},"comment":{"url":"https://api.github.com/repos/maxmind/geoip-api-c/issues/comments/162570745","html_url":"https://github.com/maxmind/geoip-api-c/issues/70#issuecomment-162570745","issue_url":"https://api.github.com/repos/maxmind/geoip-api-c/issues/70","id":162570745,"user":{"login":"oschwald","id":278835,"avatar_url":"https://avatars.githubusercontent.com/u/278835?v=3","gravatar_id":"","url":"https://api.github.com/users/oschwald","html_url":"https://github.com/oschwald","followers_url":"https://api.github.com/users/oschwald/followers","following_url":"https://api.github.com/users/oschwald/following{/other_user}","gists_url":"https://api.github.com/users/oschwald/gists{/gist_id}","starred_url":"https://api.github.com/users/oschwald/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oschwald/subscriptions","organizations_url":"https://api.github.com/users/oschwald/orgs","repos_url":"https://api.github.com/users/oschwald/repos","events_url":"https://api.github.com/users/oschwald/events{/privacy}","received_events_url":"https://api.github.com/users/oschwald/received_events","type":"User","site_admin":false},"created_at":"2015-12-07T16:09:16Z","updated_at":"2015-12-07T16:09:16Z","body":"I believe this has been fixed. I am closing the issue, but please let us know if you see a similar issue in any future databases. As you suggested, we added additional checks to help ensure that these records were not too long. Thanks for bringing this up!"}}