Consume the preference before reading the locator in NID/L64/L32 tostruct

tostruct_nid() and tostruct_l64() read the 16-bit preference with the
non-consuming uint16_fromregion() and then memmove()'d the whole
remaining region -- still ten octets, still anchored at the preference
-- into the eight-octet nid[]/l64[] arrays. That folded the preference
into the first two locator octets and stored two octets past the end of
the array. tostruct_l32() shares the root cause: it read the 32-bit
locator from the same unconsumed offset, so the value was built from the
preference plus the first two locator octets.

Consume the two preference octets first, matching the sibling
tostruct_lp(), and assert the expected framing on the fixed-size types.

diff --git a/lib/dns/rdata/generic/l32_105.c b/lib/dns/rdata/generic/l32_105.c
index 9657711bb83de0cfb5118756be18e0a837f8c92f..5f2d8933bb8c503a6f340037c7b4a132bb03a9e1 100644 (file)
--- a/lib/dns/rdata/generic/l32_105.c
+++ b/lib/dns/rdata/generic/l32_105.c
@@ -156,6 +156,8 @@ tostruct_l32(ARGS_TOSTRUCT) {
 
        dns_rdata_toregion(rdata, &region);
        l32->pref = uint16_fromregion(&region);
+       isc_region_consume(&region, 2);
+       INSIST(region.length == sizeof(l32->l32));
        n = uint32_fromregion(&region);
        l32->l32.s_addr = htonl(n);
        return ISC_R_SUCCESS;

diff --git a/lib/dns/rdata/generic/l64_106.c b/lib/dns/rdata/generic/l64_106.c
index 5e9b42e451bf33e3e783cd8af2a018d83277c670..493264fa553078a874002f3447aed5f21ba7954f 100644 (file)
--- a/lib/dns/rdata/generic/l64_106.c
+++ b/lib/dns/rdata/generic/l64_106.c
@@ -151,6 +151,8 @@ tostruct_l64(ARGS_TOSTRUCT) {
 
        dns_rdata_toregion(rdata, &region);
        l64->pref = uint16_fromregion(&region);
+       isc_region_consume(&region, 2);
+       INSIST(region.length == sizeof(l64->l64));
        memmove(l64->l64, region.base, region.length);
        return ISC_R_SUCCESS;
 }

diff --git a/lib/dns/rdata/generic/nid_104.c b/lib/dns/rdata/generic/nid_104.c
index 80d0533057991520632d726792dcbf6ca7fa1b90..275772b9e40fad0bb33ca580ede015fedaf07729 100644 (file)
--- a/lib/dns/rdata/generic/nid_104.c
+++ b/lib/dns/rdata/generic/nid_104.c
@@ -151,6 +151,8 @@ tostruct_nid(ARGS_TOSTRUCT) {
 
        dns_rdata_toregion(rdata, &region);
        nid->pref = uint16_fromregion(&region);
+       isc_region_consume(&region, 2);
+       INSIST(region.length == sizeof(nid->nid));
        memmove(nid->nid, region.base, region.length);
        return ISC_R_SUCCESS;
 }