Add a maximum length for isc_url_parse() input buffer

The isc_url_parse() function failed to check the input buffer's
length and assumed that it can't be bigger than UINT16_MAX, because
both the 'off' and 'len' fields of the 'isc_url_parser_t' structure
are uint16_t.

Add a check to not accept a buffer longer than UINT16_MAX.

diff --git a/lib/isc/url.c b/lib/isc/url.c
index eaa10129b0d08d7b108cbf837907e88bdb33b107..6d378039a42ce2e460afd86a5245d86cae01923f 100644 (file)
--- a/lib/isc/url.c
+++ b/lib/isc/url.c
@@ -549,8 +549,8 @@ isc_url_parse(const char *buf, size_t buflen, bool is_connect,
        int found_at = 0;
        const char *p = NULL;
 
-       if (buflen == 0) {
-               return ISC_R_FAILURE;
+       if (buflen == 0 || buflen > UINT16_MAX) {
+               return ISC_R_RANGE;
        }
 
        up->port = up->field_set = 0;