diff options
| author | Elliott Hughes <enh@google.com> | 2016-12-08 21:17:17 +0000 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2016-12-08 21:17:17 +0000 |
| commit | 91b8b9dd71a5b40ca00239b7f69b5d1bc53ade68 (patch) | |
| tree | e24f4e34e106e200f285483ebdcdf94d0195e42b | |
| parent | 83b0671a33a0da3d0ed962f8f01ff166069093dd (diff) | |
| parent | 62b2f0523e394a919d76d2d7caa801ac4ea78eb9 (diff) | |
| download | bionic-91b8b9dd71a5b40ca00239b7f69b5d1bc53ade68.tar.gz | |
Check for bad packets in getaddrinfo.c's getanswer. am: 9ea3f1c8a5
am: 62b2f0523e
Change-Id: I32e6e9d2747364697846ff47ff0622fff260d319
| -rw-r--r-- | libc/dns/gethnamaddr.c | 7 | ||||
| -rw-r--r-- | libc/dns/net/getaddrinfo.c | 18 |
2 files changed, 18 insertions, 7 deletions
diff --git a/libc/dns/gethnamaddr.c b/libc/dns/gethnamaddr.c index 1d847b834..674b3cbec 100644 --- a/libc/dns/gethnamaddr.c +++ b/libc/dns/gethnamaddr.c @@ -163,16 +163,13 @@ dprintf(const char *msg, res_state res, ...) #define BOUNDED_INCR(x) \ do { \ + BOUNDS_CHECK(cp, (x)); \ cp += (x); \ - if (cp > eom) { \ - h_errno = NO_RECOVERY; \ - return NULL; \ - } \ } while (/*CONSTCOND*/0) #define BOUNDS_CHECK(ptr, count) \ do { \ - if ((ptr) + (count) > eom) { \ + if (eom - (ptr) < (count)) { \ h_errno = NO_RECOVERY; \ return NULL; \ } \ diff --git a/libc/dns/net/getaddrinfo.c b/libc/dns/net/getaddrinfo.c index 2612d6a4d..7e36c20b8 100644 --- a/libc/dns/net/getaddrinfo.c +++ b/libc/dns/net/getaddrinfo.c @@ -1299,6 +1299,17 @@ ip6_str2scopeid(char *scope, struct sockaddr_in6 *sin6, u_int32_t *scopeid) static const char AskedForGot[] = "gethostby*.getanswer: asked for \"%s\", got \"%s\""; +#define BOUNDED_INCR(x) \ + do { \ + BOUNDS_CHECK(cp, x); \ + cp += (x); \ + } while (/*CONSTCOND*/0) + +#define BOUNDS_CHECK(ptr, count) \ + do { \ + if (eom - (ptr) < (count)) { h_errno = NO_RECOVERY; return NULL; } \ + } while (/*CONSTCOND*/0) + static struct addrinfo * getanswer(const querybuf *answer, int anslen, const char *qname, int qtype, const struct addrinfo *pai) @@ -1344,7 +1355,8 @@ getanswer(const querybuf *answer, int anslen, const char *qname, int qtype, qdcount = ntohs(hp->qdcount); bp = hostbuf; ep = hostbuf + sizeof hostbuf; - cp = answer->buf + HFIXEDSZ; + cp = answer->buf; + BOUNDED_INCR(HFIXEDSZ); if (qdcount != 1) { h_errno = NO_RECOVERY; return (NULL); @@ -1354,7 +1366,7 @@ getanswer(const querybuf *answer, int anslen, const char *qname, int qtype, h_errno = NO_RECOVERY; return (NULL); } - cp += n + QFIXEDSZ; + BOUNDED_INCR(n + QFIXEDSZ); if (qtype == T_A || qtype == T_AAAA || qtype == T_ANY) { /* res_send() has already verified that the query name is the * same as the one we sent; this just gets the expanded name @@ -1379,12 +1391,14 @@ getanswer(const querybuf *answer, int anslen, const char *qname, int qtype, continue; } cp += n; /* name */ + BOUNDS_CHECK(cp, 3 * INT16SZ + INT32SZ); type = _getshort(cp); cp += INT16SZ; /* type */ class = _getshort(cp); cp += INT16SZ + INT32SZ; /* class, TTL */ n = _getshort(cp); cp += INT16SZ; /* len */ + BOUNDS_CHECK(cp, n); if (class != C_IN) { /* XXX - debug? syslog? */ cp += n; |