|
 |
c745460 |
From 6a0b00f0d66490e074323d04782e75c4ba8a3f8d Mon Sep 17 00:00:00 2001
|
|
|
c745460 |
From: Simon Kelley <simon@thekelleys.org.uk>
|
|
|
c745460 |
Date: Mon, 25 Sep 2017 20:19:55 +0100
|
|
|
c745460 |
Subject: [PATCH 8/9] Misc code cleanups arising from Google analysis. No
|
|
|
c745460 |
security impleications or CVEs.
|
|
|
c745460 |
|
|
|
c745460 |
---
|
|
|
c745460 |
src/edns0.c | 2 +-
|
|
|
c745460 |
src/rfc1035.c | 4 +++-
|
|
|
c745460 |
src/rfc2131.c | 2 +-
|
|
|
c745460 |
3 files changed, 5 insertions(+), 3 deletions(-)
|
|
|
c745460 |
|
|
|
c745460 |
diff --git a/src/edns0.c b/src/edns0.c
|
|
|
c745460 |
index 89b2692..7ed5a47 100644
|
|
|
c745460 |
--- a/src/edns0.c
|
|
|
c745460 |
+++ b/src/edns0.c
|
|
|
c745460 |
@@ -159,7 +159,7 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
|
|
|
c745460 |
/* delete option if we're to replace it. */
|
|
|
c745460 |
p -= 4;
|
|
|
c745460 |
rdlen -= len + 4;
|
|
|
c745460 |
- memcpy(p, p+len+4, rdlen - i);
|
|
|
c745460 |
+ memmove(p, p+len+4, rdlen - i);
|
|
|
c745460 |
PUTSHORT(rdlen, lenp);
|
|
|
c745460 |
lenp -= 2;
|
|
|
c745460 |
}
|
|
|
c745460 |
diff --git a/src/rfc1035.c b/src/rfc1035.c
|
|
|
c745460 |
index 826f8a4..27af023 100644
|
|
|
c745460 |
--- a/src/rfc1035.c
|
|
|
c745460 |
+++ b/src/rfc1035.c
|
|
|
c745460 |
@@ -37,7 +37,7 @@ int extract_name(struct dns_header *header, size_t plen, unsigned char **pp,
|
|
|
c745460 |
/* end marker */
|
|
|
c745460 |
{
|
|
|
c745460 |
/* check that there are the correct no of bytes after the name */
|
|
|
c745460 |
- if (!CHECK_LEN(header, p, plen, extrabytes))
|
|
|
c745460 |
+ if (!CHECK_LEN(header, p1 ? p1 : p, plen, extrabytes))
|
|
|
c745460 |
return 0;
|
|
|
c745460 |
|
|
|
c745460 |
if (isExtract)
|
|
|
c745460 |
@@ -498,6 +498,8 @@ static unsigned char *do_doctor(unsigned char *p, int count, struct dns_header *
|
|
|
c745460 |
{
|
|
|
c745460 |
unsigned int i, len = *p1;
|
|
|
c745460 |
unsigned char *p2 = p1;
|
|
|
c745460 |
+ if ((p1 + len - p) >= rdlen)
|
|
|
c745460 |
+ return 0; /* bad packet */
|
|
|
c745460 |
/* make counted string zero-term and sanitise */
|
|
|
c745460 |
for (i = 0; i < len; i++)
|
|
|
c745460 |
{
|
|
|
c745460 |
diff --git a/src/rfc2131.c b/src/rfc2131.c
|
|
|
c745460 |
index f7c1f80..f3a7e53 100644
|
|
|
c745460 |
--- a/src/rfc2131.c
|
|
|
c745460 |
+++ b/src/rfc2131.c
|
|
|
c745460 |
@@ -157,7 +157,7 @@ size_t dhcp_reply(struct dhcp_context *context, char *iface_name, int int_index,
|
|
|
c745460 |
for (offset = 0; offset < (len - 5); offset += elen + 5)
|
|
|
c745460 |
{
|
|
|
c745460 |
elen = option_uint(opt, offset + 4 , 1);
|
|
|
c745460 |
- if (option_uint(opt, offset, 4) == BRDBAND_FORUM_IANA)
|
|
|
c745460 |
+ if (option_uint(opt, offset, 4) == BRDBAND_FORUM_IANA && offset + elen + 5 <= len)
|
|
|
c745460 |
{
|
|
|
c745460 |
unsigned char *x = option_ptr(opt, offset + 5);
|
|
|
c745460 |
unsigned char *y = option_ptr(opt, offset + elen + 5);
|
|
|
c745460 |
--
|
|
|
c745460 |
2.9.5
|
|
|
c745460 |
|