Address theoretical buffer overrun in recent change

The strlcat() call was wrong.

    *** CID 316608:  Memory - corruptions  (OVERRUN)
    /lib/dns/resolver.c: 5017 in fctx_create()
    5011     	 * Make fctx->info point to a copy of a formatted string
    5012     	 * "name/type".
    5013     	 */
    5014     	dns_name_format(name, buf, sizeof(buf));
    5015     	dns_rdatatype_format(type, typebuf, sizeof(typebuf));
    5016     	p = strlcat(buf, "/", sizeof(buf));
    >>>     CID 316608:  Memory - corruptions  (OVERRUN)
    >>>     Calling "strlcat" with "buf + p" and "1036UL" is suspicious because "buf" points into a buffer of 1036 bytes and the function call may access "(char *)(buf + p) + 1035UL". [Note: The source code implementation of the function has been overridden by a builtin model.]
    5017     	strlcat(buf + p, typebuf, sizeof(buf));
    5018     	fctx->info = isc_mem_strdup(mctx, buf);
    5019
    5020     	FCTXTRACE("create");
    5021     	dns_name_init(&fctx->name, NULL);
    5022     	dns_name_dup(name, mctx, &fctx->name);

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index bae5a2bd0a8e01f5a249166791296c9078b6ea04..a91a5d52ff732cf715827bc5d7d3b4b43cf7acec 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -4983,7 +4983,6 @@ fctx_create(dns_resolver_t *res, const dns_name_t *name, dns_rdatatype_t type,
        isc_interval_t interval;
        unsigned int findoptions = 0;
        char buf[DNS_NAME_FORMATSIZE + DNS_RDATATYPE_FORMATSIZE + 1];
-       char typebuf[DNS_RDATATYPE_FORMATSIZE];
        isc_mem_t *mctx;
        size_t p;
        bool try_stale;
@@ -5012,9 +5011,9 @@ fctx_create(dns_resolver_t *res, const dns_name_t *name, dns_rdatatype_t type,
         * "name/type".
         */
        dns_name_format(name, buf, sizeof(buf));
-       dns_rdatatype_format(type, typebuf, sizeof(typebuf));
        p = strlcat(buf, "/", sizeof(buf));
-       strlcat(buf + p, typebuf, sizeof(buf));
+       INSIST(p + DNS_RDATATYPE_FORMATSIZE < sizeof(buf));
+       dns_rdatatype_format(type, buf + p, sizeof(buf) - p);
        fctx->info = isc_mem_strdup(mctx, buf);
 
        FCTXTRACE("create");