diff options
Diffstat (limited to 'resolv/res_send.c')
| -rw-r--r-- | resolv/res_send.c | 42 |
1 files changed, 39 insertions, 3 deletions
diff --git a/resolv/res_send.c b/resolv/res_send.c index eb159be456..e5c6e032e8 100644 --- a/resolv/res_send.c +++ b/resolv/res_send.c @@ -214,6 +214,8 @@ res_isourserver(inp) /* int * res_nameinquery(name, type, class, buf, eom) * look for (name,type,class) in the query section of packet (buf,eom) + * requires: + * buf + HFIXESDZ <= eom * returns: * -1 : format error * 0 : not found @@ -238,6 +240,8 @@ res_nameinquery(name, type, class, buf, eom) if (n < 0) return (-1); cp += n; + if (cp + 2 * INT16SZ > eom) + return (-1); ttype = _getshort(cp); cp += INT16SZ; tclass = _getshort(cp); cp += INT16SZ; if (ttype == type && @@ -267,6 +271,9 @@ res_queriesmatch(buf1, eom1, buf2, eom2) register const u_char *cp = buf1 + HFIXEDSZ; int qdcount = ntohs(((HEADER*)buf1)->qdcount); + if (buf1 + HFIXEDSZ > eom1 || buf2 + HFIXEDSZ > eom2) + return (-1); + if (qdcount != ntohs(((HEADER*)buf2)->qdcount)) return (0); while (qdcount-- > 0) { @@ -277,6 +284,8 @@ res_queriesmatch(buf1, eom1, buf2, eom2) if (n < 0) return (-1); cp += n; + if (cp + 2 * INT16SZ > eom1) + return (-1); ttype = _getshort(cp); cp += INT16SZ; tclass = _getshort(cp); cp += INT16SZ; if (!res_nameinquery(tname, ttype, tclass, buf2, eom2)) @@ -302,6 +311,10 @@ res_send(buf, buflen, ans, anssiz) /* errno should have been set by res_init() in this case. */ return (-1); } + if (anssiz < HFIXEDSZ) { + __set_errno (EINVAL); + return (-1); + } DprintQ((_res.options & RES_DEBUG) || (_res.pfcode & RES_PRF_QUERY), (stdout, ";; res_send()\n"), buf, buflen); v_circuit = (_res.options & RES_USEVC) || buflen > PACKETSZ; @@ -446,6 +459,17 @@ read_len: len = anssiz; } else len = resplen; + if (len < HFIXEDSZ) { + /* + * Undersized message. + */ + Dprint(_res.options & RES_DEBUG, + (stdout, ";; undersized: %d\n", len)); + terrno = EMSGSIZE; + badns |= (1 << ns); + res_close(); + goto next_ns; + } cp = ans; while (len != 0 && (n = read(s, (char *)cp, (int)len)) > 0) { @@ -601,12 +625,12 @@ read_len: if ((long) timeout.tv_sec <= 0) timeout.tv_sec = 1; timeout.tv_usec = 0; - if (s+1 > FD_SETSIZE) { - Perror(stderr, "s+1 > FD_SETSIZE", EMFILE); + wait: + if (s < 0 || s >= FD_SETSIZE) { + Perror(stderr, "s out-of-bounds", EMFILE); res_close(); goto next_ns; } - wait: FD_ZERO(&dsmask); FD_SET(s, &dsmask); n = select(s+1, &dsmask, (fd_set *)NULL, @@ -638,6 +662,18 @@ read_len: goto next_ns; } gotsomewhere = 1; + if (resplen < HFIXEDSZ) { + /* + * Undersized message. + */ + Dprint(_res.options & RES_DEBUG, + (stdout, ";; undersized: %d\n", + resplen)); + terrno = EMSGSIZE; + badns |= (1 << ns); + res_close(); + goto next_ns; + } if (hp->id != anhp->id) { /* * response from old query, ignore it. |