numnicks: fix unsigned underflow OOB write in base64toip()

[MrIron-no]

Summary

base64toip() (ircd/numnicks.c) parses the P10 base64 IP field of a
server NICK introduction with no length validation. Two defects in the
non-IPv4 path are memory-safety bugs reachable from any established
server-to-server link.

1. Unsigned underflow → multi-gigabyte out-of-bounds write (CWE-191 → CWE-787)

The _ compression marker computes its fill count as:

for (left = (25 - strlen(input)) / 3 - pos; left; left--)
  addr->in6_16[pos++] = 0;

25 is int, strlen() is size_t, so the subtraction is unsigned.
For any remainder longer than 25 characters it wraps to a value near
2^64, survives / 3 and - pos, and truncates into the 32-bit loop
counter. The loop then zeroes ~1.4 billion words upward from the 16-byte
struct irc_in_addr, overrunning the stack local in ms_nick()
(m_nick.c:415) or the heap Client in set_nick_name()
(s_user.c:551), and crashes the server before it relays the line.

The counter never lands in a small range across the reachable input
space, so the write length is not attacker-controlled. This is a
remote denial of service with collateral corruption, not a route to code
execution.

2. Unchecked group read → information leak

The decode loop reads three bytes per group with no end-of-string check,
so a short field (e.g. AB) consumes past the terminating NUL and
assembles adjacent read-buffer bytes into the stored IP, later visible
through oper WHOIS/USERIP/WHO %i and matched against G-lines.

Reachability

Both callers are on the server NICK path and take the IP as
parv[parc - 3] with no prior validation. Trigger:

<numnick> N badguy 1 1234567890 user host +i ____________________________________ AAAAA :real name

Requires a linked peer (a compromised/buggy server or a services package
emitting a malformed IP field), not a plain client. That is the threat
model IRC networks operate under: a single compromised leaf should not be
able to kill its hub.

Fix

Validate the input shape in base64toip():

• cap the encoding at 24 characters, which makes the underflow
  unreachable;
• compute the _ compression by assigning pos = 8 - words rather than
  running a loop whose bound can wrap, rejecting a non-whole or
  overflowing word count;
• require three readable characters before decoding each group.

Malformed input now yields the all-zero address, matching the function's
existing silent contract. No signature or call-site change.

Tests

Regression coverage added to ircd/test/ircd_in_addr_t.c:

1. overlong _ field (with and without leading groups) — the underflow;
2. a two-character field guarded against adjacent-buffer leakage;
3. a full round-trip of every iptobase64() form (IPv4, IPv6, and _
   compression at start/middle/end);
4. the maximal 24-character encoding.

A trailing canary region around the destination catches any bounded
overrun in addition to a crash. Cases 1–3 crash or fail on the pre-fix
function and pass after.

Verified with a paired build of the same test binary against the
pre-fix and post-fix numnicks.o:

Source under test	Result
pre-fix numnicks	exit 139 (SIGSEGV in base64toip)
post-fix numnicks	exit 0 (all pass)