pullup:

 519.   [bug]           dns_name_split() would improperly split some bitstring
                        labels, zeroing a few of the least signficant bits in
                        the prefix part.  When such an improperly created
                        prefix was returned to the RBT database, the bogus
                        label was dutifully stored, corrupting the tree.
                        [RT #369]

diff --git a/CHANGES b/CHANGES
index f18e5ed436ffee34d391b0f9eeece97ab24f116c..eb7bca6532a239f30e7c9e4a9fca06f7da8ac795 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,10 @@
+ 519.  [bug]           dns_name_split() would improperly split some bitstring
+                       labels, zeroing a few of the least signficant bits in
+                       the prefix part.  When such an improperly created
+                       prefix was returned to the RBT database, the bogus
+                       label was dutifully stored, corrupting the tree.
+                       [RT #369]
+
  518.  [bug]           The resolver did not realize that a DNAME which was
                        "the answer" to the client's query was "the answer",
                        and such queries would fail. [RT #399]

diff --git a/lib/dns/name.c b/lib/dns/name.c
index 67690c9f61451463d8eb9e40ed289beb62b0748d..9c88601a127e7b59b37f2522821d3b7fc93bb15f 100644 (file)
--- a/lib/dns/name.c
+++ b/lib/dns/name.c
@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: name.c,v 1.93 2000/06/22 21:54:32 tale Exp $ */
+/* $Id: name.c,v 1.93.2.1 2000/10/16 23:32:34 bwelling Exp $ */
 
 #include <config.h>
 
@@ -2704,6 +2704,15 @@ dns_name_split(dns_name_t *name,
                                        memcpy(dst, src, len);
 
                        } else {
+                               /*
+                                * p is adjusted to point to the last byte of
+                                * the starting bitstring label to make it
+                                * cheap to determine when bits from the next
+                                * byte should be shifted into the low order
+                                * bits of the current byte.
+                                */
+                               p = src + (mod + *p - 1) / 8;
+
                                while (len--) {
                                        *dst = *src++ << mod;
                                        /*
@@ -2711,7 +2720,7 @@ dns_name_split(dns_name_t *name,
                                         * against arithmetic sign extension
                                         * by the right shift.
                                         */
-                                       if (len > 0)
+                                       if (src <= p)
                                                *dst++ |=
                                                        (*src >> (8 - mod)) &
                                                        ~(0xFF << mod);