Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/netbsd-1-5]: src/lib/libc/net Pull up revisions 1.45-1.46 (requested by ...
details: https://anonhg.NetBSD.org/src/rev/fcd4593ca2af
branches: netbsd-1-5
changeset: 493131:fcd4593ca2af
user: he <he%NetBSD.org@localhost>
date: Wed Jun 26 16:13:25 2002 +0000
description:
Pull up revisions 1.45-1.46 (requested by itojun):
Fix remote buffer overrun on hostbuf[]. Also fix up logic of
buffer handling.
diffstat:
lib/libc/net/gethnamaddr.c | 57 ++++++++++++++++++---------------------------
1 files changed, 23 insertions(+), 34 deletions(-)
diffs (247 lines):
diff -r aa48101886da -r fcd4593ca2af lib/libc/net/gethnamaddr.c
--- a/lib/libc/net/gethnamaddr.c Wed Jun 12 20:46:23 2002 +0000
+++ b/lib/libc/net/gethnamaddr.c Wed Jun 26 16:13:25 2002 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: gethnamaddr.c,v 1.33.4.1 2000/07/30 05:45:30 itojun Exp $ */
+/* $NetBSD: gethnamaddr.c,v 1.33.4.2 2002/06/26 16:13:25 he Exp $ */
/*
* ++Copyright++ 1985, 1988, 1993
@@ -61,7 +61,7 @@
static char sccsid[] = "@(#)gethostnamadr.c 8.1 (Berkeley) 6/4/93";
static char rcsid[] = "Id: gethnamaddr.c,v 8.21 1997/06/01 20:34:37 vixie Exp ";
#else
-__RCSID("$NetBSD: gethnamaddr.c,v 1.33.4.1 2000/07/30 05:45:30 itojun Exp $");
+__RCSID("$NetBSD: gethnamaddr.c,v 1.33.4.2 2002/06/26 16:13:25 he Exp $");
#endif
#endif /* LIBC_SCCS and not lint */
@@ -153,7 +153,7 @@
static struct hostent *getanswer __P((const querybuf *, int,
const char *, int));
static void map_v4v6_address __P((const char *, char *));
-static void map_v4v6_hostent __P((struct hostent *, char **, int *));
+static void map_v4v6_hostent __P((struct hostent *, char **, char *));
#ifdef RESOLVSORT
static void addrsort __P((char **, int));
#endif
@@ -237,8 +237,8 @@
const u_char *cp;
int n;
const u_char *eom, *erdata;
- char *bp, **ap, **hap;
- int type, class, buflen, ancount, qdcount;
+ char *bp, **ap, **hap, *ep;
+ int type, class, ancount, qdcount;
int haveanswer, had_error;
int toobig = 0;
char tbuf[MAXDNAME];
@@ -269,14 +269,14 @@
ancount = ntohs(hp->ancount);
qdcount = ntohs(hp->qdcount);
bp = hostbuf;
- buflen = sizeof hostbuf;
+ ep = hostbuf + sizeof hostbuf;
cp = answer->buf;
BOUNDED_INCR(HFIXEDSZ);
if (qdcount != 1) {
h_errno = NO_RECOVERY;
return (NULL);
}
- n = dn_expand(answer->buf, eom, cp, bp, buflen);
+ n = dn_expand(answer->buf, eom, cp, bp, ep - bp);
if ((n < 0) || !(*name_ok)(bp)) {
h_errno = NO_RECOVERY;
return (NULL);
@@ -294,7 +294,6 @@
}
host.h_name = bp;
bp += n;
- buflen -= n;
/* The qname can be abbreviated, but h_name is now absolute. */
qname = host.h_name;
}
@@ -307,7 +306,7 @@
haveanswer = 0;
had_error = 0;
while (ancount-- > 0 && cp < eom && !had_error) {
- n = dn_expand(answer->buf, eom, cp, bp, buflen);
+ n = dn_expand(answer->buf, eom, cp, bp, ep - bp);
if ((n < 0) || !(*name_ok)(bp)) {
had_error++;
continue;
@@ -348,17 +347,15 @@
continue;
}
bp += n;
- buflen -= n;
/* Get canonical name. */
n = strlen(tbuf) + 1; /* for the \0 */
- if (n > buflen || n >= MAXHOSTNAMELEN) {
+ if (n > ep - bp || n >= MAXHOSTNAMELEN) {
had_error++;
continue;
}
strcpy(bp, tbuf);
host.h_name = bp;
bp += n;
- buflen -= n;
continue;
}
if (qtype == T_PTR && type == T_CNAME) {
@@ -374,14 +371,13 @@
}
/* Get canonical name. */
n = strlen(tbuf) + 1; /* for the \0 */
- if (n > buflen || n >= MAXHOSTNAMELEN) {
+ if (n > ep - bp || n >= MAXHOSTNAMELEN) {
had_error++;
continue;
}
strcpy(bp, tbuf);
tname = bp;
bp += n;
- buflen -= n;
continue;
}
if (type != qtype) {
@@ -401,7 +397,7 @@
cp += n;
continue; /* XXX - had_error++ ? */
}
- n = dn_expand(answer->buf, eom, cp, bp, buflen);
+ n = dn_expand(answer->buf, eom, cp, bp, ep - bp);
if ((n < 0) || !res_hnok(bp)) {
had_error++;
break;
@@ -425,7 +421,6 @@
break;
}
bp += n;
- buflen -= n;
}
break;
#else
@@ -437,8 +432,7 @@
break;
}
bp += n;
- buflen -= n;
- map_v4v6_hostent(&host, &bp, &buflen);
+ map_v4v6_hostent(&host, &bp, ep);
}
h_errno = NETDB_SUCCESS;
return (&host);
@@ -461,7 +455,6 @@
host.h_name = bp;
nn = strlen(bp) + 1; /* for the \0 */
bp += nn;
- buflen -= nn;
}
bp += sizeof(align) -
@@ -481,7 +474,6 @@
}
(void)memcpy(*hap++ = bp, cp, (size_t)n);
bp += n;
- buflen -= n;
cp += n;
if (cp != erdata) {
h_errno = NO_RECOVERY;
@@ -508,15 +500,14 @@
# endif /*RESOLVSORT*/
if (!host.h_name) {
n = strlen(qname) + 1; /* for the \0 */
- if (n > buflen || n >= MAXHOSTNAMELEN)
+ if (n > ep - bp || n >= MAXHOSTNAMELEN)
goto no_recovery;
strcpy(bp, qname);
host.h_name = bp;
bp += n;
- buflen -= n;
}
if (_res.options & RES_USE_INET6)
- map_v4v6_hostent(&host, &bp, &buflen);
+ map_v4v6_hostent(&host, &bp, ep);
h_errno = NETDB_SUCCESS;
return (&host);
}
@@ -551,8 +542,8 @@
int af;
{
const char *cp;
- char *bp;
- int size, len;
+ char *bp, *ep;
+ int size;
struct hostent *hp;
static const ns_dtab dtab[] = {
NS_FILES_CB(_gethtbyname, NULL)
@@ -609,7 +600,7 @@
strncpy(hostbuf, name, MAXDNAME);
hostbuf[MAXDNAME] = '\0';
bp = hostbuf + MAXDNAME;
- len = sizeof hostbuf - MAXDNAME;
+ ep = hostbuf + sizeof hostbuf;
host.h_name = hostbuf;
host.h_aliases = host_aliases;
host_aliases[0] = NULL;
@@ -617,7 +608,7 @@
h_addr_ptrs[1] = NULL;
host.h_addr_list = h_addr_ptrs;
if (_res.options & RES_USE_INET6)
- map_v4v6_hostent(&host, &bp, &len);
+ map_v4v6_hostent(&host, &bp, ep);
h_errno = NETDB_SUCCESS;
return (&host);
}
@@ -643,7 +634,7 @@
strncpy(hostbuf, name, MAXDNAME);
hostbuf[MAXDNAME] = '\0';
bp = hostbuf + MAXDNAME;
- len = sizeof hostbuf - MAXDNAME;
+ ep = hostbuf + sizeof hostbuf;
host.h_name = hostbuf;
host.h_aliases = host_aliases;
host_aliases[0] = NULL;
@@ -660,7 +651,7 @@
hp = (struct hostent *)NULL;
h_errno = NETDB_INTERNAL;
if (nsdispatch(&hp, dtab, NSDB_HOSTS, "gethostbyname",
- default_dns_files, name, len, af) != NS_SUCCESS)
+ default_dns_files, name, strlen(name), af) != NS_SUCCESS)
return (struct hostent *)NULL;
h_errno = NETDB_SUCCESS;
return (hp);
@@ -992,10 +983,10 @@
}
static void
-map_v4v6_hostent(hp, bpp, lenp)
+map_v4v6_hostent(hp, bpp, ep)
struct hostent *hp;
char **bpp;
- int *lenp;
+ char *ep;
{
char **ap;
@@ -1010,17 +1001,15 @@
for (ap = hp->h_addr_list; *ap; ap++) {
int i = sizeof(align) - (size_t)((u_long)*bpp % sizeof(align));
- if (*lenp < (i + IN6ADDRSZ)) {
+ if (ep - *bpp < (i + IN6ADDRSZ)) {
/* Out of memory. Truncate address list here. XXX */
*ap = NULL;
return;
}
*bpp += i;
- *lenp -= i;
map_v4v6_address(*ap, *bpp);
*ap = *bpp;
*bpp += IN6ADDRSZ;
- *lenp -= IN6ADDRSZ;
}
}
Home |
Main Index |
Thread Index |
Old Index