summaryrefslogtreecommitdiff
path: root/networking
diff options
context:
space:
mode:
authorDenys Vlasenko2021-02-22 15:36:07 +0100
committerDenys Vlasenko2021-02-22 15:36:07 +0100
commit9fa7d7d97d374b091819670299f25cad87a75779 (patch)
treee854a91bbdd27b84685030e8318e69652b07ba32 /networking
parenta4959eef71067dd6763bf60113bdeafdcb5f2d91 (diff)
downloadbusybox-9fa7d7d97d374b091819670299f25cad87a75779.zip
busybox-9fa7d7d97d374b091819670299f25cad87a75779.tar.gz
dnsd: check that we don't read past packet
function old new delta dnsd_main 1296 1304 +8 Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat (limited to 'networking')
-rw-r--r--networking/dnsd.c17
1 files changed, 12 insertions, 5 deletions
diff --git a/networking/dnsd.c b/networking/dnsd.c
index 0ff0290..a0f320c 100644
--- a/networking/dnsd.c
+++ b/networking/dnsd.c
@@ -379,7 +379,8 @@ Domain name in a message can be represented as either:
*/
static int process_packet(struct dns_entry *conf_data,
uint32_t conf_ttl,
- uint8_t *buf)
+ uint8_t *buf,
+ unsigned buflen)
{
struct dns_head *head;
struct type_and_class *unaligned_type_class;
@@ -402,9 +403,6 @@ static int process_packet(struct dns_entry *conf_data,
bb_simple_error_msg("response packet, ignored");
return 0; /* don't reply */
}
- /* QR = 1 "response", RCODE = 4 "Not Implemented" */
- outr_flags = htons(0x8000 | 4);
- err_msg = NULL;
/* start of query string */
query_string = (void *)(head + 1);
@@ -416,6 +414,15 @@ static int process_packet(struct dns_entry *conf_data,
/* where to append answer block */
answb = (void *)(unaligned_type_class + 1);
+ if (buflen < answb - buf) {
+ bb_simple_error_msg("packet too short");
+ return 0; /* don't reply */
+ }
+
+ /* QR = 1 "response", RCODE = 4 "Not Implemented" */
+ outr_flags = htons(0x8000 | 4);
+ err_msg = NULL;
+
/* OPCODE != 0 "standard query"? */
if ((head->flags & htons(0x7800)) != 0) {
err_msg = "opcode != 0";
@@ -559,7 +566,7 @@ int dnsd_main(int argc UNUSED_PARAM, char **argv)
if (OPT_verbose)
bb_simple_info_msg("got UDP packet");
buf[r] = '\0'; /* paranoia */
- r = process_packet(conf_data, conf_ttl, buf);
+ r = process_packet(conf_data, conf_ttl, buf, r);
if (r <= 0)
continue;
send_to_from(udps, buf, r, 0, &from->u.sa, &to->u.sa, lsa->len);