1236. [bug] dns_rdata{class,type}_fromtext() didn't handle non

                        NULL terminated text regions. [RT #2588]

diff --git a/CHANGES b/CHANGES
index 8377bb83b79581572ad49079a8d8b0a659666f64..1ce830ebc88a79475ab1d1f8fda015a9fb13013d 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+1236.  [bug]           dns_rdata{class,type}_fromtext() didn't handle non
+                       NULL terminated text regions. [RT #2588]
+
 1235.  [func]          Report 'out of memory' errors from openssl.
 
 1234.  [bug]           contrib/sdb: 'zonetodb' failed to call

diff --git a/lib/dns/gen.c b/lib/dns/gen.c
index 00b9c05f4ddf851856670f644e011c06d5fc6f9e..dae8b15b0e205fff2b6ce42c18dc39dcfaac6647 100644 (file)
--- a/lib/dns/gen.c
+++ b/lib/dns/gen.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: gen.c,v 1.67 2001/11/27 00:55:52 gson Exp $ */
+/* $Id: gen.c,v 1.68 2002/03/20 17:12:28 marka Exp $ */
 
 #include <config.h>
 
@@ -666,9 +666,11 @@ main(int argc, char **argv) {
                 * Here, walk the list from top to bottom, calculating
                 * the hash (mod 256) for each name.
                 */
-               fprintf(stdout, "#define RDATATYPE_COMPARE(_s, _d, _tn, _tp) \\\n");
+               fprintf(stdout, "#define RDATATYPE_COMPARE(_s, _d, _tn, _n, _tp) \\\n");
                fprintf(stdout, "\tdo { \\\n");
-               fprintf(stdout, "\t\tif (strcasecmp(_s,(_tn)) == 0) { \\\n");
+               fprintf(stdout, "\t\tif (sizeof(_s) - 1 == _n && \\\n"
+                               "\t\t    strncasecmp(_s,(_tn),"
+                               "(sizeof(_s) - 1)) == 0) { \\\n");
                fprintf(stdout, "\t\t\tif ((typeattr[_d].flags & "
                                  "DNS_RDATATYPEATTR_RESERVED) != 0) \\\n");
                fprintf(stdout, "\t\t\t\treturn (ISC_R_NOTIMPLEMENTED); \\\n");
@@ -677,8 +679,8 @@ main(int argc, char **argv) {
                fprintf(stdout, "\t\t} \\\n");
                fprintf(stdout, "\t} while (0)\n\n");
 
-               fprintf(stdout, "#define RDATATYPE_FROMTEXT_SW(_hash,_typename,_typep) "
-                      "\\\n");
+               fprintf(stdout, "#define RDATATYPE_FROMTEXT_SW(_hash,"
+                               "_typename,_length,_typep) \\\n");
                fprintf(stdout, "\tswitch (_hash) { \\\n");
                for (i = 0; i <= 255; i++) {
                        ttn = &typenames[i];
@@ -703,7 +705,7 @@ main(int argc, char **argv) {
                                if (hash == HASH(ttn2->typename)) {
                                        fprintf(stdout, "\t\t\tRDATATYPE_COMPARE"
                                               "(\"%s\", %u, "
-                                              "_typename, _typep); \\\n",
+                                              "_typename, _length, _typep); \\\n",
                                               ttn2->typename, j);
                                        ttn2->sorted = 1;
                                }

diff --git a/lib/dns/rdata.c b/lib/dns/rdata.c
index edbd7fabb9ad0be31eb567ab813c8bdc33d88aa1..b3e1e96b2ccf3c8de4647e8c35bc413d52ed3f3a 100644 (file)
--- a/lib/dns/rdata.c
+++ b/lib/dns/rdata.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdata.c,v 1.166 2002/03/17 18:59:43 bwelling Exp $ */
+/* $Id: rdata.c,v 1.167 2002/03/20 17:12:29 marka Exp $ */
 
 #include <config.h>
 #include <ctype.h>
@@ -1066,11 +1066,17 @@ dns_rdataclass_fromtext(dns_rdataclass_t *classp, isc_textregion_t *source) {
                 */
                COMPARE("ch", dns_rdataclass_chaos);
                COMPARE("chaos", dns_rdataclass_chaos);
+
                if (source->length > 5 &&
-                   strncasecmp("class", source->base, 5) == 0)
-               {
+                   source->length < (5 + sizeof("65000")) &&
+                   strncasecmp("class", source->base, 4) == 0) {
+                       char buf[sizeof("65000")];
                        char *endp;
-                       int val = strtol(source->base + 5, &endp, 10);
+                       int val;
+
+                       strncpy(buf, source->base + 4, sizeof(buf));
+                       buf[sizeof(buf) - 1] = '\0';
+                       val = strtol(buf, &endp, 10);
                        if (*endp == '\0' && val >= 0 && val <= 0xffff) {
                                *classp = (dns_rdataclass_t)val;
                                return (ISC_R_SUCCESS);
@@ -1165,11 +1171,17 @@ dns_rdatatype_fromtext(dns_rdatatype_t *typep, isc_textregion_t *source) {
         * to return a result to the caller if it is a valid (known)
         * rdatatype name.
         */
-       RDATATYPE_FROMTEXT_SW(hash, source->base, typep);
+       RDATATYPE_FROMTEXT_SW(hash, source->base, n, typep);
 
-       if (source->length > 4 && strncasecmp("type", source->base, 4) == 0) {
+       if (source->length > 4 && source->length < (4 + sizeof("65000")) &&
+           strncasecmp("type", source->base, 4) == 0) {
+               char buf[sizeof("65000")];
                char *endp;
-               int val = strtol(source->base + 4, &endp, 10);
+               int val;
+
+               strncpy(buf, source->base + 4, sizeof(buf));
+               buf[sizeof(buf) - 1] = '\0';
+               val = strtol(buf, &endp, 10);
                if (*endp == '\0' && val >= 0 && val <= 0xffff) {
                        *typep = (dns_rdatatype_t)val;
                        return (ISC_R_SUCCESS);