fix the domain name length limit checks
A domain name is at most 255 bytes long (RFC 1035), but the string representation is two bytes smaller so the strlen maximum is 253.
This commit is contained in:
@@ -14,7 +14,7 @@
|
|||||||
static int is_valid_hostname(const char *host)
|
static int is_valid_hostname(const char *host)
|
||||||
{
|
{
|
||||||
const unsigned char *s;
|
const unsigned char *s;
|
||||||
if (strnlen(host, 256)-1 > 254 || mbstowcs(0, host, 0) > 255) return 0;
|
if (strnlen(host, 254)-1 >= 253 || mbstowcs(0, host, 0) == -1) return 0;
|
||||||
for (s=(void *)host; *s>=0x80 || *s=='.' || *s=='-' || isalnum(*s); s++);
|
for (s=(void *)host; *s>=0x80 || *s=='.' || *s=='-' || isalnum(*s); s++);
|
||||||
return !*s;
|
return !*s;
|
||||||
}
|
}
|
||||||
@@ -153,7 +153,7 @@ int __lookup_name(struct address buf[static MAXADDRS], char canon[static 256], c
|
|||||||
*canon = 0;
|
*canon = 0;
|
||||||
if (name) {
|
if (name) {
|
||||||
size_t l;
|
size_t l;
|
||||||
if ((l = strnlen(name, 256))-1 > 254)
|
if ((l = strnlen(name, 254))-1 >= 253)
|
||||||
return EAI_NONAME;
|
return EAI_NONAME;
|
||||||
memcpy(canon, name, l+1);
|
memcpy(canon, name, l+1);
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -10,9 +10,9 @@ int __res_mkquery(int op, const char *dname, int class, int type,
|
|||||||
int id, i, j;
|
int id, i, j;
|
||||||
unsigned char q[280];
|
unsigned char q[280];
|
||||||
struct timespec ts;
|
struct timespec ts;
|
||||||
size_t l = strnlen(dname, 256);
|
size_t l = strnlen(dname, 254);
|
||||||
|
|
||||||
if (l-1>=254 || buflen<18+l || op>15u || class>255u || type>255u)
|
if (l-1>=253 || buflen<18+l || op>15u || class>255u || type>255u)
|
||||||
return -1;
|
return -1;
|
||||||
|
|
||||||
/* Construct query template - ID will be filled later */
|
/* Construct query template - ID will be filled later */
|
||||||
|
|||||||
@@ -3,10 +3,10 @@
|
|||||||
|
|
||||||
int res_querydomain(const char *name, const char *domain, int class, int type, unsigned char *dest, int len)
|
int res_querydomain(const char *name, const char *domain, int class, int type, unsigned char *dest, int len)
|
||||||
{
|
{
|
||||||
char tmp[256];
|
char tmp[254];
|
||||||
size_t nl = strnlen(name, 256);
|
size_t nl = strnlen(name, 254);
|
||||||
size_t dl = strnlen(domain, 256);
|
size_t dl = strnlen(domain, 254);
|
||||||
if (nl+dl+1 > 255) return -1;
|
if (nl+dl+1 > 253) return -1;
|
||||||
memcpy(tmp, name, nl);
|
memcpy(tmp, name, nl);
|
||||||
tmp[nl] = '.';
|
tmp[nl] = '.';
|
||||||
memcpy(tmp+nl+1, domain, dl+1);
|
memcpy(tmp+nl+1, domain, dl+1);
|
||||||
|
|||||||
Reference in New Issue
Block a user