2177. [bug] Array bounds overrun on read (rcodetext). [RT #16798]

diff --git a/CHANGES b/CHANGES
index 816a9c0c3fbfb85ce855b844d2ae2dc7ae7e586b..5e8e5763faedc10478a535e78164fc9df1a1a0d5 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+2177.  [bug]           Array bounds overrun on read (rcodetext). [RT #16798]
+
 2176.  [contrib]       dbus update to handle race condition during
                        initialisation (Bugzilla 235809). [RT #16842]
 

diff --git a/lib/dns/message.c b/lib/dns/message.c
index a4a1f8781202956c407b3619ca53488d9124f48b..e5ebd5e819831a9757d3c01f29447d24aca09fe8 100644 (file)
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: message.c,v 1.222.18.10 2006/03/02 23:19:20 marka Exp $ */
+/* $Id: message.c,v 1.222.18.11 2007/05/15 02:03:35 marka Exp $ */
 
 /*! \file */
 
@@ -3007,8 +3007,7 @@ dns_message_sectiontotext(dns_message_t *msg, dns_section_t section,
                ADD_STRING(target, ";; ");
                if (msg->opcode != dns_opcode_update) {
                        ADD_STRING(target, sectiontext[section]);
-               }
-               else {
+               } else {
                        ADD_STRING(target, updsectiontext[section]);
                }
                ADD_STRING(target, " SECTION:\n");
@@ -3130,7 +3129,12 @@ dns_message_totext(dns_message_t *msg, const dns_master_style_t *style,
                ADD_STRING(target, ";; ->>HEADER<<- opcode: ");
                ADD_STRING(target, opcodetext[msg->opcode]);
                ADD_STRING(target, ", status: ");
-               ADD_STRING(target, rcodetext[msg->rcode]);
+               if (msg->rcode < (sizeof(rcodetext)/sizeof(rcodetext[0]))) {
+                       ADD_STRING(target, rcodetext[msg->rcode]);
+               } else {
+                       snprintf(buf, sizeof(buf), "%4u", msg->rcode);
+                       ADD_STRING(target, buf);
+               }
                ADD_STRING(target, ", id: ");
                snprintf(buf, sizeof(buf), "%6u", msg->id);
                ADD_STRING(target, buf);