diff options
| author | nectar <nectar@FreeBSD.org> | 2002-09-15 16:51:09 +0000 |
|---|---|---|
| committer | nectar <nectar@FreeBSD.org> | 2002-09-15 16:51:09 +0000 |
| commit | b44001f0c35c71357de671925af59585fe44a345 (patch) | |
| tree | b148cf252878680c37bb7a53070e4d454eed0300 /lib/libc/net/name6.c | |
| parent | 486bc9dab8aab95468a5910f1ad064ed33582577 (diff) | |
| download | FreeBSD-src-b44001f0c35c71357de671925af59585fe44a345.zip FreeBSD-src-b44001f0c35c71357de671925af59585fe44a345.tar.gz | |
Check for truncation in calls to res_send/res_query/res_search.
Fail when it is detected.
Diffstat (limited to 'lib/libc/net/name6.c')
| -rw-r--r-- | lib/libc/net/name6.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/lib/libc/net/name6.c b/lib/libc/net/name6.c index d80f9c2..3fa8aae 100644 --- a/lib/libc/net/name6.c +++ b/lib/libc/net/name6.c @@ -1287,7 +1287,7 @@ _res_search_multi(name, rtl, errp) rtl = SLIST_NEXT(rtl, rtl_entry)) { ret = res_query(cp, C_IN, rtl->rtl_type, buf.buf, sizeof(buf.buf)); - if (ret > 0) { + if (ret > 0 && ret < sizeof(buf.buf)) { hpbuf.h_addrtype = (rtl->rtl_type == T_AAAA) ? AF_INET6 : AF_INET; hpbuf.h_length = ADDRLEN(hpbuf.h_addrtype); @@ -1312,7 +1312,7 @@ _res_search_multi(name, rtl, errp) rtl = SLIST_NEXT(rtl, rtl_entry)) { ret = res_querydomain(name, NULL, C_IN, rtl->rtl_type, buf.buf, sizeof(buf.buf)); - if (ret > 0) { + if (ret > 0 && ret < sizeof(buf.buf)) { hpbuf.h_addrtype = (rtl->rtl_type == T_AAAA) ? AF_INET6 : AF_INET; hpbuf.h_length = ADDRLEN(hpbuf.h_addrtype); @@ -1349,7 +1349,7 @@ _res_search_multi(name, rtl, errp) ret = res_querydomain(name, *domain, C_IN, rtl->rtl_type, buf.buf, sizeof(buf.buf)); - if (ret > 0) { + if (ret > 0 && ret < sizeof(buf.buf)) { hpbuf.h_addrtype = (rtl->rtl_type == T_AAAA) ? AF_INET6 : AF_INET; hpbuf.h_length = ADDRLEN(hpbuf.h_addrtype); @@ -1419,7 +1419,7 @@ _res_search_multi(name, rtl, errp) rtl = SLIST_NEXT(rtl, rtl_entry)) { ret = res_querydomain(name, NULL, C_IN, rtl->rtl_type, buf.buf, sizeof(buf.buf)); - if (ret > 0) { + if (ret > 0 && ret < sizeof(buf.buf)) { hpbuf.h_addrtype = (rtl->rtl_type == T_AAAA) ? AF_INET6 : AF_INET; hpbuf.h_length = ADDRLEN(hpbuf.h_addrtype); @@ -1570,6 +1570,12 @@ _dns_ghbyaddr(void *rval, void *cb_data, va_list ap) if (n < 0) { *errp = h_errno; return NS_UNAVAIL; + } else if (n > sizeof(buf.buf)) { +#if 0 + errno = ERANGE; /* XXX is it OK to set errno here? */ +#endif + *errp = NETDB_INTERNAL; + return NS_UNAVAIL; } hp = getanswer(&buf, n, qbuf, T_PTR, &hbuf, errp); if (!hp) |
