Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/netbsd-1-6]: src/lib/libc/net Pull up revision 1.46 (requested by itojun...
details: https://anonhg.NetBSD.org/src/rev/d015b5caf8b1
branches: netbsd-1-6
changeset: 528093:d015b5caf8b1
user: lukem <lukem%NetBSD.org@localhost>
date: Wed Jun 26 11:11:15 2002 +0000
description:
Pull up revision 1.46 (requested by itojun in ticket #371):
avoid remote buffer overrun on hostbuf[]. From: Joost Pol <joost%pine.nl@localhost>
correct bad practice in the code - it uses two changing variables
to manage buffer (buf and buflen). we eliminate buflen and use
fixed point (ep) as the ending pointer.
this fix is critical.
diffstat:
lib/libc/net/gethnamaddr.c | 55 ++++++++++++++++++---------------------------
1 files changed, 22 insertions(+), 33 deletions(-)
diffs (238 lines):
diff -r d1dbe41b0122 -r d015b5caf8b1 lib/libc/net/gethnamaddr.c
--- a/lib/libc/net/gethnamaddr.c Wed Jun 26 11:07:57 2002 +0000
+++ b/lib/libc/net/gethnamaddr.c Wed Jun 26 11:11:15 2002 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: gethnamaddr.c,v 1.42.2.1 2002/06/26 11:07:57 lukem Exp $ */
+/* $NetBSD: gethnamaddr.c,v 1.42.2.2 2002/06/26 11:11:15 lukem Exp $ */
/*
* ++Copyright++ 1985, 1988, 1993
@@ -61,7 +61,7 @@
static char sccsid[] = "@(#)gethostnamadr.c 8.1 (Berkeley) 6/4/93";
static char rcsid[] = "Id: gethnamaddr.c,v 8.21 1997/06/01 20:34:37 vixie Exp ";
#else
-__RCSID("$NetBSD: gethnamaddr.c,v 1.42.2.1 2002/06/26 11:07:57 lukem Exp $");
+__RCSID("$NetBSD: gethnamaddr.c,v 1.42.2.2 2002/06/26 11:11:15 lukem Exp $");
#endif
#endif /* LIBC_SCCS and not lint */
@@ -152,7 +152,7 @@
static struct hostent *getanswer __P((const querybuf *, int,
const char *, int));
static void map_v4v6_address __P((const char *, char *));
-static void map_v4v6_hostent __P((struct hostent *, char **, int *));
+static void map_v4v6_hostent __P((struct hostent *, char **, char *));
#ifdef RESOLVSORT
static void addrsort __P((char **, int));
#endif
@@ -234,8 +234,8 @@
const u_char *cp;
int n;
const u_char *eom, *erdata;
- char *bp, **ap, **hap;
- int type, class, buflen, ancount, qdcount;
+ char *bp, **ap, **hap, *ep;
+ int type, class, ancount, qdcount;
int haveanswer, had_error;
int toobig = 0;
char tbuf[MAXDNAME];
@@ -266,14 +266,14 @@
ancount = ntohs(hp->ancount);
qdcount = ntohs(hp->qdcount);
bp = hostbuf;
- buflen = sizeof hostbuf;
+ ep = hostbuf + sizeof hostbuf;
cp = answer->buf;
BOUNDED_INCR(HFIXEDSZ);
if (qdcount != 1) {
h_errno = NO_RECOVERY;
return (NULL);
}
- n = dn_expand(answer->buf, eom, cp, bp, buflen);
+ n = dn_expand(answer->buf, eom, cp, bp, ep - bp);
if ((n < 0) || !(*name_ok)(bp)) {
h_errno = NO_RECOVERY;
return (NULL);
@@ -291,7 +291,6 @@
}
host.h_name = bp;
bp += n;
- buflen -= n;
/* The qname can be abbreviated, but h_name is now absolute. */
qname = host.h_name;
}
@@ -304,7 +303,7 @@
haveanswer = 0;
had_error = 0;
while (ancount-- > 0 && cp < eom && !had_error) {
- n = dn_expand(answer->buf, eom, cp, bp, buflen);
+ n = dn_expand(answer->buf, eom, cp, bp, ep - bp);
if ((n < 0) || !(*name_ok)(bp)) {
had_error++;
continue;
@@ -345,17 +344,15 @@
continue;
}
bp += n;
- buflen -= n;
/* Get canonical name. */
n = strlen(tbuf) + 1; /* for the \0 */
- if (n > buflen || n >= MAXHOSTNAMELEN) {
+ if (n > ep - bp || n >= MAXHOSTNAMELEN) {
had_error++;
continue;
}
strcpy(bp, tbuf);
host.h_name = bp;
bp += n;
- buflen -= n;
continue;
}
if (qtype == T_PTR && type == T_CNAME) {
@@ -371,14 +368,13 @@
}
/* Get canonical name. */
n = strlen(tbuf) + 1; /* for the \0 */
- if (n > buflen || n >= MAXHOSTNAMELEN) {
+ if (n > ep - bp || n >= MAXHOSTNAMELEN) {
had_error++;
continue;
}
strcpy(bp, tbuf);
tname = bp;
bp += n;
- buflen -= n;
continue;
}
if (type != qtype) {
@@ -398,7 +394,7 @@
cp += n;
continue; /* XXX - had_error++ ? */
}
- n = dn_expand(answer->buf, eom, cp, bp, buflen);
+ n = dn_expand(answer->buf, eom, cp, bp, ep - bp);
if ((n < 0) || !res_hnok(bp)) {
had_error++;
break;
@@ -422,7 +418,6 @@
break;
}
bp += n;
- buflen -= n;
}
break;
#else
@@ -434,8 +429,7 @@
break;
}
bp += n;
- buflen -= n;
- map_v4v6_hostent(&host, &bp, &buflen);
+ map_v4v6_hostent(&host, &bp, ep);
}
h_errno = NETDB_SUCCESS;
return (&host);
@@ -458,7 +452,6 @@
host.h_name = bp;
nn = strlen(bp) + 1; /* for the \0 */
bp += nn;
- buflen -= nn;
}
bp += sizeof(align) -
@@ -478,7 +471,6 @@
}
(void)memcpy(*hap++ = bp, cp, (size_t)n);
bp += n;
- buflen -= n;
cp += n;
if (cp != erdata) {
h_errno = NO_RECOVERY;
@@ -505,15 +497,14 @@
# endif /*RESOLVSORT*/
if (!host.h_name) {
n = strlen(qname) + 1; /* for the \0 */
- if (n > buflen || n >= MAXHOSTNAMELEN)
+ if (n > ep - bp || n >= MAXHOSTNAMELEN)
goto no_recovery;
strcpy(bp, qname);
host.h_name = bp;
bp += n;
- buflen -= n;
}
if (_res.options & RES_USE_INET6)
- map_v4v6_hostent(&host, &bp, &buflen);
+ map_v4v6_hostent(&host, &bp, ep);
h_errno = NETDB_SUCCESS;
return (&host);
}
@@ -548,8 +539,8 @@
int af;
{
const char *cp;
- char *bp;
- int size, len;
+ char *bp, *ep;
+ int size;
struct hostent *hp;
static const ns_dtab dtab[] = {
NS_FILES_CB(_gethtbyname, NULL)
@@ -606,7 +597,7 @@
strncpy(hostbuf, name, MAXDNAME);
hostbuf[MAXDNAME] = '\0';
bp = hostbuf + MAXDNAME;
- len = sizeof hostbuf - MAXDNAME;
+ ep = hostbuf + sizeof hostbuf;
host.h_name = hostbuf;
host.h_aliases = host_aliases;
host_aliases[0] = NULL;
@@ -614,7 +605,7 @@
h_addr_ptrs[1] = NULL;
host.h_addr_list = h_addr_ptrs;
if (_res.options & RES_USE_INET6)
- map_v4v6_hostent(&host, &bp, &len);
+ map_v4v6_hostent(&host, &bp, ep);
h_errno = NETDB_SUCCESS;
return (&host);
}
@@ -640,7 +631,7 @@
strncpy(hostbuf, name, MAXDNAME);
hostbuf[MAXDNAME] = '\0';
bp = hostbuf + MAXDNAME;
- len = sizeof hostbuf - MAXDNAME;
+ ep = hostbuf + sizeof hostbuf;
host.h_name = hostbuf;
host.h_aliases = host_aliases;
host_aliases[0] = NULL;
@@ -996,10 +987,10 @@
}
static void
-map_v4v6_hostent(hp, bpp, lenp)
+map_v4v6_hostent(hp, bpp, ep)
struct hostent *hp;
char **bpp;
- int *lenp;
+ char *ep;
{
char **ap;
@@ -1014,17 +1005,15 @@
for (ap = hp->h_addr_list; *ap; ap++) {
int i = sizeof(align) - (size_t)((u_long)*bpp % sizeof(align));
- if (*lenp < (i + IN6ADDRSZ)) {
+ if (ep - *bpp < (i + IN6ADDRSZ)) {
/* Out of memory. Truncate address list here. XXX */
*ap = NULL;
return;
}
*bpp += i;
- *lenp -= i;
map_v4v6_address(*ap, *bpp);
*ap = *bpp;
*bpp += IN6ADDRSZ;
- *lenp -= IN6ADDRSZ;
}
}
Home |
Main Index |
Thread Index |
Old Index