>Number:         17525
>Category:       bin
>Synopsis:       cut&paste error in one of the fixes for the in-tree BIND
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jul 08 11:51:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Greg A. Woods
>Release:        NetBSD-current 2002/07/07
>Organization:
Planix, Inc.; Toronto, Ontario; Canada
>Environment:
System: NetBSD
>Description:

	one of the fixes for the in-tree BIND-8 has a bad cut&paste
	error reminiscent of a C programmer doing too much Python
	programming!  :-)

>How-To-Repeat:

	examine the following diff:

Index: lib/nameser/ns_name.c
===================================================================
RCS file: /cvs/master/m-NetBSD/main/basesrc/dist/bind/lib/nameser/ns_name.c,v
retrieving revision 1.1.1.4
retrieving revision 1.5
diff -c -r1.1.1.4 -r1.5
*** lib/nameser/ns_name.c	20 Jun 2002 10:30:38 -0000	1.1.1.4
--- lib/nameser/ns_name.c	4 Jul 2002 23:30:40 -0000	1.5
***************
*** 790,796 ****
  {
  	const char *cp = *cpp;
  	char *beg = dn, tc;
! 	int b, blen, plen;
  
  	if ((blen = (*cp & 0xff)) == 0)
  		blen = 256;
--- 790,796 ----
  {
  	const char *cp = *cpp;
  	char *beg = dn, tc;
! 	int b, blen, plen, i;
  
  	if ((blen = (*cp & 0xff)) == 0)
  		blen = 256;
***************
*** 800,817 ****
  		return(-1);
  
  	cp++;
! 	dn += SPRINTF((dn, "\\[x"));
  	for (b = blen; b > 7; b -= 8, cp++)
! 		dn += SPRINTF((dn, "%02x", *cp & 0xff));
  	if (b > 4) {
  		tc = *cp++;
! 		dn += SPRINTF((dn, "%02x", tc & (0xff << (8 - b))));
  	} else if (b > 0) {
  		tc = *cp++;
! 		dn += SPRINTF((dn, "%1x",
  			       ((tc >> 4) & 0x0f) & (0x0f << (4 - b)))); 
  	}
! 	dn += SPRINTF((dn, "/%d]", blen));
  
  	*cpp = cp;
  	return(dn - beg);
--- 800,832 ----
  		return(-1);
  
  	cp++;
! 	i = SPRINTF((dn, "\\[x"));
! 	if (i < 0)
! 		return (-1);
! 	dn += i;
  	for (b = blen; b > 7; b -= 8, cp++)
! 		i = SPRINTF((dn, "%02x", *cp & 0xff));
! 		if (i < 0)
! 			return (-1);
! 		dn += i;
  	if (b > 4) {
  		tc = *cp++;
! 		i = SPRINTF((dn, "%02x", tc & (0xff << (8 - b))));
! 		if (i < 0)
! 			return (-1);
! 		dn += i;
  	} else if (b > 0) {
  		tc = *cp++;
! 		i = SPRINTF((dn, "%1x",
  			       ((tc >> 4) & 0x0f) & (0x0f << (4 - b)))); 
+ 		if (i < 0)
+ 			return (-1);
+ 		dn += i;
  	}
! 	i = SPRINTF((dn, "/%d]", blen));
! 	if (i < 0)
! 		return (-1);
! 	dn += i;
  
  	*cpp = cp;
  	return(dn - beg);

>Fix:

	wrap the full body of the modified 'for' statement in braces....

>Release-Note:
>Audit-Trail:
>Unformatted: