From: Natanael Copa <ncopa@alpinelinux.org>
To: Szabolcs Nagy <nsz@port70.net>
Cc: musl@lists.openwall.com
Subject: Re: [PATCH] fix handling of zero length domain names in dn_expand
Date: Thu, 4 Sep 2014 22:22:16 +0200 [thread overview]
Message-ID: <20140904222216.3b40e730@ncopa-laptop> (raw)
In-Reply-To: <20140904181128.GD10361@port70.net>
On Thu, 4 Sep 2014 20:11:29 +0200
Szabolcs Nagy <nsz@port70.net> wrote:
> From 1a068a048b64999f97add01ce8f5013a83b0e916 Mon Sep 17 00:00:00 2001
> From: Szabolcs Nagy <nsz@port70.net>
> Date: Thu, 4 Sep 2014 18:29:16 +0200
> Subject: [PATCH] fix dn_expand empty name handling and offsets to 0
>
> Empty name was rejected in dn_expand since commit
> 56b57f37a46dab432247bf29d96fcb11fbd02a6d
> which is a regression as reported by Natanael Copa.
>
> Furthermore if an offset pointer in a compressed name
> pointed to a terminating 0 byte (instead of a label)
> the returned name was not null terminated.
> ---
> src/network/dn_expand.c | 14 ++++++++------
> 1 file changed, 8 insertions(+), 6 deletions(-)
>
> diff --git a/src/network/dn_expand.c b/src/network/dn_expand.c
> index 849df19..d1ebebf 100644
> --- a/src/network/dn_expand.c
> +++ b/src/network/dn_expand.c
> @@ -5,8 +5,8 @@ int __dn_expand(const unsigned char *base, const unsigned char *end, const unsig
> {
> const unsigned char *p = src;
> char *dend = dest + (space > 254 ? 254 : space);
> - int len = -1, i, j;
> - if (p==end || !*p) return -1;
> + int len = -1, i, j, first = 1;
How about, instead of adding int first, we do:
char *dest_start = dest;
> + if (p==end || dest==dend) return -1;
> /* detect reference loop using an iteration counter */
> for (i=0; i < end-base; i+=2) {
> if (*p & 0xc0) {
> @@ -16,11 +16,13 @@ int __dn_expand(const unsigned char *base, const unsigned char *end, const unsig
> if (j >= end-base) return -1;
> p = base+j;
> } else if (*p) {
> - j = *p+1;
> - if (j>=end-p || j>dend-dest) return -1;
> - while (--j) *dest++ = *++p;
> - *dest++ = *++p ? '.' : 0;
> + if (!first) *dest++ = '.';
> + first = 0;
and instead of the 2 above:
if (dest != dest_start) *dest++ = '.';
> + j = *p++;
> + if (j >= end-p || j >= dend-dest) return -1;
> + while (j--) *dest++ = *p++;
> } else {
> + *dest = 0;
> if (len < 0) len = p+1-src;
> return len;
> }
-nc
prev parent reply other threads:[~2014-09-04 20:22 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-08-13 8:21 Natanael Copa
[not found] ` <20140904095039.496f5810@ncopa-desktop.alpinelinux.org>
2014-09-04 17:07 ` Szabolcs Nagy
2014-09-04 18:11 ` Szabolcs Nagy
2014-09-04 20:20 ` Rich Felker
2014-09-04 22:15 ` Szabolcs Nagy
2014-09-04 22:41 ` Rich Felker
2014-09-04 20:22 ` Natanael Copa [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140904222216.3b40e730@ncopa-laptop \
--to=ncopa@alpinelinux.org \
--cc=musl@lists.openwall.com \
--cc=nsz@port70.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).