[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 4 Sep 2014 22:22:16 +0200
From: Natanael Copa <ncopa@...inelinux.org>
To: Szabolcs Nagy <nsz@...t70.net>
Cc: musl@...ts.openwall.com
Subject: Re: [PATCH] fix handling of zero length domain names in
dn_expand
On Thu, 4 Sep 2014 20:11:29 +0200
Szabolcs Nagy <nsz@...t70.net> wrote:
> From 1a068a048b64999f97add01ce8f5013a83b0e916 Mon Sep 17 00:00:00 2001
> From: Szabolcs Nagy <nsz@...t70.net>
> Date: Thu, 4 Sep 2014 18:29:16 +0200
> Subject: [PATCH] fix dn_expand empty name handling and offsets to 0
>
> Empty name was rejected in dn_expand since commit
> 56b57f37a46dab432247bf29d96fcb11fbd02a6d
> which is a regression as reported by Natanael Copa.
>
> Furthermore if an offset pointer in a compressed name
> pointed to a terminating 0 byte (instead of a label)
> the returned name was not null terminated.
> ---
> src/network/dn_expand.c | 14 ++++++++------
> 1 file changed, 8 insertions(+), 6 deletions(-)
>
> diff --git a/src/network/dn_expand.c b/src/network/dn_expand.c
> index 849df19..d1ebebf 100644
> --- a/src/network/dn_expand.c
> +++ b/src/network/dn_expand.c
> @@ -5,8 +5,8 @@ int __dn_expand(const unsigned char *base, const unsigned char *end, const unsig
> {
> const unsigned char *p = src;
> char *dend = dest + (space > 254 ? 254 : space);
> - int len = -1, i, j;
> - if (p==end || !*p) return -1;
> + int len = -1, i, j, first = 1;
How about, instead of adding int first, we do:
char *dest_start = dest;
> + if (p==end || dest==dend) return -1;
> /* detect reference loop using an iteration counter */
> for (i=0; i < end-base; i+=2) {
> if (*p & 0xc0) {
> @@ -16,11 +16,13 @@ int __dn_expand(const unsigned char *base, const unsigned char *end, const unsig
> if (j >= end-base) return -1;
> p = base+j;
> } else if (*p) {
> - j = *p+1;
> - if (j>=end-p || j>dend-dest) return -1;
> - while (--j) *dest++ = *++p;
> - *dest++ = *++p ? '.' : 0;
> + if (!first) *dest++ = '.';
> + first = 0;
and instead of the 2 above:
if (dest != dest_start) *dest++ = '.';
> + j = *p++;
> + if (j >= end-p || j >= dend-dest) return -1;
> + while (j--) *dest++ = *p++;
> } else {
> + *dest = 0;
> if (len < 0) len = p+1-src;
> return len;
> }
-nc
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
