Fix PROXYv2 header size truncation bug

The 'isc_proxy2_handler_t' structure stores some size values in a
'uint16_t' type, while the maximum size can be bigger, which results
in truncation. Change the affected types to 'size_t'.

diff --git a/lib/isc/include/isc/proxy2.h b/lib/isc/include/isc/proxy2.h
index 175e5052ce33386b50be37db924f177f056defe0..61f2f41f501f1ff8bf1c7f46665cf5d55482cac2 100644 (file)
--- a/lib/isc/include/isc/proxy2.h
+++ b/lib/isc/include/isc/proxy2.h
@@ -293,7 +293,7 @@ struct isc_proxy2_handler {
        int      state;       /*!< Current state machine state */
        uint16_t expect_data; /*!< How much data do we need to switch to the
                                 next state */
-       uint16_t max_size; /*!< Max PROXYv2 header size including its payload */
+       size_t max_size; /*!< Max PROXYv2 header size including its payload */
 
        isc_proxy2_handler_cb_t cb;    /*!< Data processing callback. */
        void                   *cbarg; /*!< Callback argument. */
@@ -304,9 +304,9 @@ struct isc_proxy2_handler {
                                status value. */
        isc_mem_t *mctx;
 
-       uint16_t header_size;   /*!< Total PROXYv2 header size (including the
-                                  payload. */
-       uint16_t tlv_data_size; /*!< The size of TLVs payload size */
+       size_t header_size;   /*!< Total PROXYv2 header size (including the
+                                payload. */
+       size_t tlv_data_size; /*!< The size of TLVs payload size */
 
        isc_proxy2_command_t    cmd; /*!< The decoded PROXYv2 command */
        isc_proxy2_addrfamily_t proxy_addr_family; /*!< The decoded PROXYv2
@@ -322,7 +322,7 @@ struct isc_proxy2_handler {
 
 void
 isc_proxy2_handler_init(isc_proxy2_handler_t *restrict handler, isc_mem_t *mctx,
-                       const uint16_t max_size, isc_proxy2_handler_cb_t cb,
+                       const size_t max_size, isc_proxy2_handler_cb_t cb,
                        void *cbarg);
 /*!<
  * \brief Initialise the given 'isc_proxy2_handler_t' object, attach
@@ -338,7 +338,8 @@ isc_proxy2_handler_init(isc_proxy2_handler_t *restrict handler, isc_mem_t *mctx,
  * Requires:
  *\li  'handler' is not NULL;
  *\li  'mctx' is not NULL;
- *\li  'max_size' is >= `ISC_PROXY2_HEADER_SIZE` or is 0;
+ *\li  'max_size' is >= `ISC_PROXY2_HEADER_SIZE` &&
+ *      is <= `ISC_PROXY2_MAX_SIZE`, or is 0;
  *\li  'cb' is not NULL.
  */
 
@@ -365,7 +366,7 @@ isc_proxy2_handler_clear(isc_proxy2_handler_t *restrict handler);
  */
 
 isc_proxy2_handler_t *
-isc_proxy2_handler_new(isc_mem_t *mctx, const uint16_t max_size,
+isc_proxy2_handler_new(isc_mem_t *mctx, const size_t max_size,
                       isc_proxy2_handler_cb_t cb, void *cbarg);
 /*!<
  * \brief Allocate and initialise a new 'isc_proxy2_handler_t'
@@ -381,7 +382,8 @@ isc_proxy2_handler_new(isc_mem_t *mctx, const uint16_t max_size,
  *
  * Requires:
  *\li  'mctx' is not NULL;
- *\li  'max_size' is >= `ISC_PROXY2_HEADER_SIZE` or is 0;
+ *\li  'max_size' is >= `ISC_PROXY2_HEADER_SIZE` &&
+ *       is <= `ISC_PROXY2_MAX_SIZE`, or is 0;
  *\li  'cb' is not NULL.
  */
 

diff --git a/lib/isc/proxy2.c b/lib/isc/proxy2.c
index 5c9644097adfe8e8b9fd0e227636b07651ee4428..3449cb257130d38d85eaf2088a17a8525d8f3610 100644 (file)
--- a/lib/isc/proxy2.c
+++ b/lib/isc/proxy2.c
@@ -22,7 +22,7 @@ enum isc_proxy2_states {
 
 static inline void
 isc__proxy2_handler_init_direct(isc_proxy2_handler_t *restrict handler,
-                               const uint16_t max_size,
+                               const size_t max_size,
                                const isc_region_t *restrict data,
                                isc_proxy2_handler_cb_t cb, void *cbarg) {
        *handler = (isc_proxy2_handler_t){ .result = ISC_R_UNSET,
@@ -40,11 +40,12 @@ isc__proxy2_handler_init_direct(isc_proxy2_handler_t *restrict handler,
 
 void
 isc_proxy2_handler_init(isc_proxy2_handler_t *restrict handler, isc_mem_t *mctx,
-                       const uint16_t max_size, isc_proxy2_handler_cb_t cb,
+                       const size_t max_size, isc_proxy2_handler_cb_t cb,
                        void *cbarg) {
        REQUIRE(handler != NULL);
        REQUIRE(mctx != NULL);
-       REQUIRE(max_size == 0 || max_size >= ISC_PROXY2_HEADER_SIZE);
+       REQUIRE(max_size == 0 || (max_size >= ISC_PROXY2_HEADER_SIZE &&
+                                 max_size <= ISC_PROXY2_MAX_SIZE));
        REQUIRE(cb != NULL);
 
        isc__proxy2_handler_init_direct(handler, max_size, NULL, cb, cbarg);
@@ -85,7 +86,7 @@ isc_proxy2_handler_clear(isc_proxy2_handler_t *restrict handler) {
 }
 
 isc_proxy2_handler_t *
-isc_proxy2_handler_new(isc_mem_t *mctx, const uint16_t max_size,
+isc_proxy2_handler_new(isc_mem_t *mctx, const size_t max_size,
                       isc_proxy2_handler_cb_t cb, void *cbarg) {
        isc_proxy2_handler_t *newhandler;
 
@@ -249,7 +250,7 @@ isc__proxy2_handler_handle_header(isc_proxy2_handler_t *restrict handler) {
        len = isc_buffer_getuint16(&handler->hdrbuf);
 
        if (handler->max_size > 0 &&
-           (len + ISC_PROXY2_HEADER_SIZE) > handler->max_size)
+           ((size_t)len + ISC_PROXY2_HEADER_SIZE) > handler->max_size)
        {
                goto error_range;
        }