2547. [bug] openssl_link.c:mem_realloc() could reference an

			out-of-range area of the source buffer.  New public
			function isc_mem_reallocate() was introduced to address
			this bug. [RT #19313]

diff --git a/CHANGES b/CHANGES
index 1eb6afadd28f5828932cc10912b2b8de86cdd5d0..c4ec2074b9ebd48f9f8435c802aeda157bb6edf4 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+2547.  [bug]           openssl_link.c:mem_realloc() could reference an
+                       out-of-range area of the source buffer.  New public
+                       function isc_mem_reallocate() was introduced to address
+                       this bug. [RT #19313]
+
 2545.  [doc]           ARM: Legal hostname checking (check-names) is
                        for SRV RDATA too. [RT #19304]
 

diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
index bb76e0e38eeabb922e87490308b4854003339c68..9ca67f4b136318c55022c40104fbc33f5811629b 100644 (file)
--- a/lib/dns/openssl_link.c
+++ b/lib/dns/openssl_link.c
@@ -18,7 +18,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: openssl_link.c,v 1.1.6.12 2007/08/28 07:20:04 tbox Exp $
+ * $Id: openssl_link.c,v 1.1.6.13 2009/02/11 03:11:39 jinmei Exp $
  */
 #ifdef OPENSSL
 
@@ -116,18 +116,8 @@ mem_free(void *ptr) {
 
 static void *
 mem_realloc(void *ptr, size_t size) {
-       void *p;
-
        INSIST(dst__memory_pool != NULL);
-       p = NULL;
-       if (size > 0U) {
-               p = mem_alloc(size);
-               if (p != NULL && ptr != NULL)
-                       memcpy(p, ptr, size);
-       }
-       if (ptr != NULL)
-               mem_free(ptr);
-       return (p);
+       return (isc_mem_reallocate(dst__memory_pool, ptr, size));
 }
 
 isc_result_t

diff --git a/lib/isc/include/isc/mem.h b/lib/isc/include/isc/mem.h
index 9d9e2fa0173577aab46dd885d8052346f2b85943..d3a77ac149d9e78fea1fb04843c0c6af8f332f54 100644 (file)
--- a/lib/isc/include/isc/mem.h
+++ b/lib/isc/include/isc/mem.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mem.h,v 1.59.18.13 2009/01/19 23:46:16 tbox Exp $ */
+/* $Id: mem.h,v 1.59.18.14 2009/02/11 03:11:39 jinmei Exp $ */
 
 #ifndef ISC_MEM_H
 #define ISC_MEM_H 1
@@ -153,6 +153,7 @@ LIBISC_EXTERNAL_DATA extern unsigned int isc_mem_debugging;
 
 #define isc_mem_get(c, s)      isc__mem_get((c), (s) _ISC_MEM_FILELINE)
 #define isc_mem_allocate(c, s) isc__mem_allocate((c), (s) _ISC_MEM_FILELINE)
+#define isc_mem_reallocate(c, p, s) isc__mem_reallocate((c), (p), (s) _ISC_MEM_FILELINE)
 #define isc_mem_strdup(c, p)   isc__mem_strdup((c), (p) _ISC_MEM_FILELINE)
 #define isc_mempool_get(c)     isc__mempool_get((c) _ISC_MEM_FILELINE)
 
@@ -551,6 +552,8 @@ void
 isc__mem_put(isc_mem_t *, void *, size_t _ISC_MEM_FLARG);
 void *
 isc__mem_allocate(isc_mem_t *, size_t _ISC_MEM_FLARG);
+void *
+isc__mem_reallocate(isc_mem_t *, void *, size_t _ISC_MEM_FLARG);
 void
 isc__mem_free(isc_mem_t *, void * _ISC_MEM_FLARG);
 char *

diff --git a/lib/isc/mem.c b/lib/isc/mem.c
index 651cb7ae75ae12bcfff8f8282f900000c7f7681f..abb9027243bdaae84f95361073c9fba85d72e00e 100644 (file)
--- a/lib/isc/mem.c
+++ b/lib/isc/mem.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mem.c,v 1.116.18.23 2009/01/22 23:46:01 tbox Exp $ */
+/* $Id: mem.c,v 1.116.18.24 2009/02/11 03:11:39 jinmei Exp $ */
 
 /*! \file */
 
@@ -1347,6 +1347,40 @@ isc__mem_allocate(isc_mem_t *ctx, size_t size FLARG) {
        return (si);
 }
 
+void *
+isc__mem_reallocate(isc_mem_t *ctx, void *ptr, size_t size FLARG) {
+       void *new_ptr = NULL;
+       size_t oldsize, copysize;
+
+       REQUIRE(VALID_CONTEXT(ctx));
+
+       /*
+        * This function emulates the realloc(3) standard library function:
+        * - if size > 0, allocate new memory; and if ptr is non NULL, copy
+        *   as much of the old contents to the new buffer and free the old one.
+        *   Note that when allocation fails the original pointer is intact;
+        *   the caller must free it.
+        * - if size is 0 and ptr is non NULL, simply free the given ptr.
+        * - this function returns:
+        *     pointer to the newly allocated memory, or
+        *     NULL if allocation fails or doesn't happen.
+        */
+       if (size > 0U) {
+               new_ptr = isc__mem_allocate(ctx, size FLARG_PASS);
+               if (new_ptr != NULL && ptr != NULL) {
+                       oldsize = (((size_info *)ptr)[-1]).u.size;
+                       INSIST(oldsize >= ALIGNMENT_SIZE);
+                       oldsize -= ALIGNMENT_SIZE;
+                       copysize = oldsize > size ? size : oldsize;
+                       memcpy(new_ptr, ptr, copysize);
+                       isc__mem_free(ctx, ptr FLARG_PASS);
+               }
+       } else if (ptr != NULL)
+               isc__mem_free(ctx, ptr FLARG_PASS);
+
+       return (new_ptr);
+}
+
 void
 isc__mem_free(isc_mem_t *ctx, void *ptr FLARG) {
        size_info *si;