Address out of bounds memory read in dnstap-read

If dnstap-read is processing a malformed file it could read
past the end of the address buffer in yaml mode.  This has
been fixed.

diff --git a/bin/tools/dnstap-read.c b/bin/tools/dnstap-read.c
index 4a382f2bb34a29948014ceb88b1288089eee28a8..360c88917825ad92accbd23e8e8aedc4a41ae859 100644 (file)
--- a/bin/tools/dnstap-read.c
+++ b/bin/tools/dnstap-read.c
@@ -187,6 +187,18 @@ cleanup:
        }
 }
 
+static void
+print_ip(ProtobufCBinaryData *ip, const char *label) {
+       char buf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:255.255.255.255")];
+       if (ip->len == 4 || ip->len == 16) {
+               if (inet_ntop(ip->len == 4 ? AF_INET : AF_INET6, ip->data, buf,
+                             sizeof(buf)) != NULL)
+               {
+                       printf("  %s: \"%s\"\n", label, buf);
+               }
+       }
+}
+
 static void
 print_yaml(dns_dtdata_t *dt) {
        Dnstap__Dnstap *frame = dt->frame;
@@ -273,20 +285,14 @@ print_yaml(dns_dtdata_t *dt) {
 
        if (m->has_query_address) {
                ProtobufCBinaryData *ip = &m->query_address;
-               char buf[100];
 
-               (void)inet_ntop(ip->len == 4 ? AF_INET : AF_INET6, ip->data,
-                               buf, sizeof(buf));
-               printf("  query_address: \"%s\"\n", buf);
+               print_ip(ip, "query_address");
        }
 
        if (m->has_response_address) {
                ProtobufCBinaryData *ip = &m->response_address;
-               char buf[100];
 
-               (void)inet_ntop(ip->len == 4 ? AF_INET : AF_INET6, ip->data,
-                               buf, sizeof(buf));
-               printf("  response_address: \"%s\"\n", buf);
+               print_ip(ip, "response_address");
        }
 
        if (m->has_query_port) {