]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
CLEANUP: resolvers: use read_n32() instead of open-coded big-endian read
authorWilly Tarreau <w@1wt.eu>
Fri, 22 May 2026 06:01:49 +0000 (06:01 +0000)
committerWilly Tarreau <w@1wt.eu>
Mon, 25 May 2026 08:57:13 +0000 (10:57 +0200)
In resolv_validate_dns_response(), the second DNS record parsing path
manually constructs a 32-bit big-endian TTL value from four individual
bytes using the expression:

  reader[0] * 16777216 + reader[1] * 65536 + reader[2] * 256 + reader[3]

We have read_n32() to do this, and it's more robust against unexpected
signedness surprises (which should not happen right here since reader is
unsigned char and we use -fwrapv so the result is defined). Also, let's
make the ttl an uint instead of an int. The TTL is only retrieved and not
used for now, so better clean it now.

include/haproxy/resolvers-t.h
src/resolvers.c

index e89f5b547a20e67c2a3d158a2cd8f97c3f9fb86b..3bdf5237ed71dd086bca9cbd3fde3aa09fcb7c6b 100644 (file)
@@ -114,7 +114,7 @@ struct resolv_answer_item {
        char            name[DNS_MAX_NAME_SIZE+1];   /* answer name */
        int16_t         type;                        /* question type */
        int16_t         class;                       /* query class */
-       int32_t         ttl;                         /* response TTL */
+       uint32_t        ttl;                         /* response TTL */
        int16_t         priority;                    /* SRV type priority */
        uint16_t        weight;                      /* SRV type weight */
        uint16_t        port;                        /* SRV type port */
index 7bf245dbc1714d18951b6afeaacfa793c5f3eba8..38e61e29ac0073e7027f0a314ff4ae3c5f348d90 100644 (file)
@@ -1236,8 +1236,7 @@ static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufe
                if (reader + 4 > bufend)
                        goto invalid_resp;
 
-               answer_record->ttl =   reader[0] * 16777216 + reader[1] * 65536
-                                    + reader[2] * 256 + reader[3];
+               answer_record->ttl = read_n32(reader);
                reader += 4;
 
                /* Now reading data len */
@@ -1498,8 +1497,7 @@ static int resolv_validate_dns_response(unsigned char *resp, unsigned char *bufe
                if (reader + 4 > bufend)
                        goto invalid_resp;
 
-               answer_record->ttl =   reader[0] * 16777216 + reader[1] * 65536
-                                    + reader[2] * 256 + reader[3];
+               answer_record->ttl = read_n32(reader);
                reader += 4;
 
                /* Now reading data len */