added some more overflow checks

added specific errors about the part of the packet that did not convert in wire2pkt

diff --git a/error.c b/error.c
index ea0075ab60933b7748abf078f0c17ea83b308774..a7aacf9a6e2f884b732508fdc16d4634742db22e 100644 (file)
--- a/error.c
+++ b/error.c
@@ -51,6 +51,11 @@ ldns_lookup_table ldns_error_str[] = {
         { LDNS_STATUS_CRYPTO_EXPIRATION_BEFORE_INCEPTION, "DNSSEC signature has expiration date earlier than inception date" },
        { LDNS_STATUS_RES_NO_NS, "No nameservers defined in the resolver" },
        { LDNS_STATUS_RES_QUERY, "No correct query given to resolver" },
+       { LDNS_STATUS_WIRE_INCOMPLETE_HEADER, "header section incomplete" },
+       { LDNS_STATUS_WIRE_INCOMPLETE_QUESTION, "question section incomplete" },
+       { LDNS_STATUS_WIRE_INCOMPLETE_ANSWER, "answer section incomplete" },
+       { LDNS_STATUS_WIRE_INCOMPLETE_AUTHORITY, "authority section incomplete" },
+       { LDNS_STATUS_WIRE_INCOMPLETE_ADDITIONAL, "additional section incomplete" },
        { 0, NULL }
 };
 

diff --git a/ldns/error.h b/ldns/error.h
index 024801b05174bf6263e90a4a628bfee8fb8c2677..b20f898e292328ebbda519a9ffde275ab859c820 100644 (file)
--- a/ldns/error.h
+++ b/ldns/error.h
@@ -54,7 +54,12 @@ enum ldns_enum_status
         LDNS_STATUS_CRYPTO_TSIG_ERR,
        LDNS_STATUS_CRYPTO_EXPIRATION_BEFORE_INCEPTION,
         LDNS_STATUS_RES_NO_NS,
-        LDNS_STATUS_RES_QUERY
+        LDNS_STATUS_RES_QUERY,
+        LDNS_STATUS_WIRE_INCOMPLETE_HEADER,
+        LDNS_STATUS_WIRE_INCOMPLETE_QUESTION,
+        LDNS_STATUS_WIRE_INCOMPLETE_ANSWER,
+        LDNS_STATUS_WIRE_INCOMPLETE_AUTHORITY,
+        LDNS_STATUS_WIRE_INCOMPLETE_ADDITIONAL
 };
 typedef enum ldns_enum_status ldns_status;
 

diff --git a/wire2host.c b/wire2host.c
index a6167620ec37859c6acb655d209e6ae5f654aa11..e4411816407d805c7d4e1a589e89b11f9d679564 100644 (file)
--- a/wire2host.c
+++ b/wire2host.c
@@ -277,6 +277,11 @@ ldns_wire2rr(ldns_rr **rr_p, const uint8_t *wire, size_t max,
 
        ldns_rr_set_owner(rr, owner);
        
+       if (*pos + 4 > max) {
+               status = LDNS_STATUS_PACKET_OVERFLOW;
+               goto status_error;
+       }
+       
        ldns_rr_set_type(rr, ldns_read_uint16(&wire[*pos]));
        *pos = *pos + 2;
 
@@ -284,6 +289,10 @@ ldns_wire2rr(ldns_rr **rr_p, const uint8_t *wire, size_t max,
        *pos = *pos + 2;
 
        if (section != LDNS_SECTION_QUESTION) {
+               if (*pos + 4 > max) {
+                       status = LDNS_STATUS_PACKET_OVERFLOW;
+                       goto status_error;
+               }
                ldns_rr_set_ttl(rr, ldns_read_uint32(&wire[*pos]));     
                *pos = *pos + 4;
                status = ldns_wire2rdf(rr, wire, max, pos);
@@ -295,7 +304,7 @@ ldns_wire2rr(ldns_rr **rr_p, const uint8_t *wire, size_t max,
        return LDNS_STATUS_OK;
        
 status_error:
-       LDNS_FREE(rr);
+       ldns_rr_free(rr);
        return status;
 }
 
@@ -306,7 +315,7 @@ ldns_wire2pkt_hdr(ldns_pkt *packet,
                        size_t *pos)
 {
        if (*pos + LDNS_HEADER_SIZE > max) {
-               return LDNS_STATUS_PACKET_OVERFLOW;
+               return LDNS_STATUS_WIRE_INCOMPLETE_HEADER;
        } else {
                ldns_pkt_set_id(packet, LDNS_ID_WIRE(wire));
                ldns_pkt_set_qr(packet, LDNS_QR_WIRE(wire));
@@ -352,10 +361,13 @@ ldns_wire2pkt(ldns_pkt **packet_p, const uint8_t *wire, size_t max)
 
        status = ldns_wire2pkt_hdr(packet, wire, max, &pos);
        LDNS_STATUS_CHECK_GOTO(status, status_error);
-       
+
        for (i = 0; i < ldns_pkt_qdcount(packet); i++) {
                status = ldns_wire2rr(&rr, wire, max, &pos,
                                      LDNS_SECTION_QUESTION);
+               if (status == LDNS_STATUS_PACKET_OVERFLOW) {
+                       status = LDNS_STATUS_WIRE_INCOMPLETE_QUESTION;
+               }
                LDNS_STATUS_CHECK_GOTO(status, status_error);
                if (!ldns_rr_list_push_rr(ldns_pkt_question(packet), rr)) {
                        ldns_pkt_free(packet);
@@ -365,6 +377,9 @@ ldns_wire2pkt(ldns_pkt **packet_p, const uint8_t *wire, size_t max)
        for (i = 0; i < ldns_pkt_ancount(packet); i++) {
                status = ldns_wire2rr(&rr, wire, max, &pos,
                                      LDNS_SECTION_ANSWER);
+               if (status == LDNS_STATUS_PACKET_OVERFLOW) {
+                       status = LDNS_STATUS_WIRE_INCOMPLETE_ANSWER;
+               }
                LDNS_STATUS_CHECK_GOTO(status, status_error);
                if (!ldns_rr_list_push_rr(ldns_pkt_answer(packet), rr)) {
                        ldns_pkt_free(packet);
@@ -374,6 +389,9 @@ ldns_wire2pkt(ldns_pkt **packet_p, const uint8_t *wire, size_t max)
        for (i = 0; i < ldns_pkt_nscount(packet); i++) {
                status = ldns_wire2rr(&rr, wire, max, &pos,
                                      LDNS_SECTION_AUTHORITY);
+               if (status == LDNS_STATUS_PACKET_OVERFLOW) {
+                       status = LDNS_STATUS_WIRE_INCOMPLETE_AUTHORITY;
+               }
                LDNS_STATUS_CHECK_GOTO(status, status_error);
                if (!ldns_rr_list_push_rr(ldns_pkt_authority(packet), rr)) {
                        ldns_pkt_free(packet);
@@ -383,6 +401,9 @@ ldns_wire2pkt(ldns_pkt **packet_p, const uint8_t *wire, size_t max)
        for (i = 0; i < ldns_pkt_arcount(packet); i++) {
                status = ldns_wire2rr(&rr, wire, max, &pos,
                                      LDNS_SECTION_ADDITIONAL);
+               if (status == LDNS_STATUS_PACKET_OVERFLOW) {
+                       status = LDNS_STATUS_WIRE_INCOMPLETE_ADDITIONAL;
+               }
                LDNS_STATUS_CHECK_GOTO(status, status_error);
                if (ldns_rr_get_type(rr) == LDNS_RR_TYPE_OPT) {
                        ldns_pkt_set_edns_udp_size(packet, ldns_rr_get_class(rr));
@@ -406,6 +427,6 @@ ldns_wire2pkt(ldns_pkt **packet_p, const uint8_t *wire, size_t max)
        return status;
        
 status_error:
-       LDNS_FREE(packet);
+       ldns_pkt_free(packet);
        return status;
 }