3party/mongoose
0
0
Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2024-12-27 15:01:03 +08:00
Code Issues Projects Releases Wiki Activity

Fix parsing truncated DNS records

Browse Source 
PUBLISHED_FROM=8b849b5dfd72bb3055df34113ec74e47c620af2e
This commit is contained in:
Deomid Ryabkov 2016-04-12 14:28:45 +02:00 committed by rojer
parent 7addae0fdd
commit 67ac6ae191
1 changed files with 20 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
mongoose.c
View File

@ -8973,13 +8973,13 @@ static unsigned char *mg_parse_dns_resource_record(
data += chunk_len + 1;
}
if (data > end - 5) {
return NULL;
}
rr->name.p = (char *) name;
rr->name.len = data - name + 1;
data++;
if (data > end - 4) {
return data;
}
rr->rtype = data[0] << 8 | data[1];
data += 2;
@ -8990,7 +8990,7 @@ static unsigned char *mg_parse_dns_resource_record(
rr->kind = reply ? MG_DNS_ANSWER : MG_DNS_QUESTION;
if (reply) {
if (data >= end - 6) {
return data;
return NULL;
}
rr->ttl = (uint32_t) data[0] << 24 | (uint32_t) data[1] << 16 |
@ -9012,25 +9012,32 @@ int mg_parse_dns(const char *buf, int len, struct mg_dns_message *msg) {
unsigned char *data = (unsigned char *) buf + sizeof(*header);
unsigned char *end = (unsigned char *) buf + len;
int i;
memset(msg, 0, sizeof(*msg));
msg->pkt.p = buf;
msg->pkt.len = len;
if (len < (int) sizeof(*header)) {
return -1; /* LCOV_EXCL_LINE */
}
if (len < (int) sizeof(*header)) return -1;
msg->transaction_id = header->transaction_id;
msg->flags = ntohs(header->flags);
msg->num_questions = ntohs(header->num_questions);
if (msg->num_questions > (int) ARRAY_SIZE(msg->questions)) {
msg->num_questions = (int) ARRAY_SIZE(msg->questions);
}
msg->num_answers = ntohs(header->num_answers);
for (i = 0; i < msg->num_questions && i < (int) ARRAY_SIZE(msg->questions);
i++) {
data = mg_parse_dns_resource_record(data, end, &msg->questions[i], 0);
if (msg->num_answers > (int) ARRAY_SIZE(msg->answers)) {
msg->num_answers = (int) ARRAY_SIZE(msg->answers);
}
for (i = 0; i < msg->num_answers && i < (int) ARRAY_SIZE(msg->answers); i++) {
for (i = 0; i < msg->num_questions; i++) {
data = mg_parse_dns_resource_record(data, end, &msg->questions[i], 0);
if (data == NULL) return -1;
}
for (i = 0; i < msg->num_answers; i++) {
data = mg_parse_dns_resource_record(data, end, &msg->answers[i], 1);
if (data == NULL) return -1;
}
return 0;