check length of txt records

git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@11475 ec53bebd-3082-4978-b11e-865c3cabbd6b

lib/roken/resolve.c

@@ -111,63 +111,19 @@ dns_free_data(struct dns_reply *r)
     free (r);
 }
 
-#ifndef TEST_RESOLVE
+static int
-static
+parse_record(const unsigned char *data, const unsigned char *end_data, 
-#endif
+	     const unsigned char **pp, struct resource_record **rr)
-struct dns_reply*
-parse_reply(const unsigned char *data, size_t len)
 {
-    const unsigned char *p;
-    char host[128];
-    int status;
-    const unsigned char *end_data = data + len;
-    struct dns_reply *r;
-    struct resource_record **rr;
-    
-    r = calloc(1, sizeof(*r));
-    if (r == NULL)
-	return NULL;
-
-    p = data;
-#if 0
-    /* doesn't work on Crays */
-    memcpy(&r->h, p, sizeof(HEADER));
-    p += sizeof(HEADER);
-#else
-    memcpy(&r->h, p, 12); /* XXX this will probably be mostly garbage */
-    p += 12;
-#endif
-    status = dn_expand(data, end_data, p, host, sizeof(host));
-    if(status < 0){
-	dns_free_data(r);
-	return NULL;
-    }
-    r->q.domain = strdup(host);
-    if(r->q.domain == NULL) {
-	dns_free_data(r);
-	return NULL;
-    }
-    if (p + status + 4 > end_data) {
-	dns_free_data(r);
-	return NULL;
-    }
-    p += status;
-    r->q.type = (p[0] << 8 | p[1]);
-    p += 2;
-    r->q.class = (p[0] << 8 | p[1]);
-    p += 2;
-    rr = &r->head;
-    while(p < end_data){
     int type, class, ttl, size;
+    int status;
+    char host[MAXDNAME];
+    const unsigned char *p = *pp;
     status = dn_expand(data, end_data, p, host, sizeof(host));
-	if(status < 0){
+    if(status < 0) 
-	    dns_free_data(r);
+	return -1;
-	    return NULL;
+    if (p + status + 10 > end_data)
-	}
+	return -1;
-	if (p + status + 10 > end_data) {
-	    dns_free_data(r);
-	    return NULL;
-	}
     p += status;
     type = (p[0] << 8) | p[1];
     p += 2;
@@ -178,21 +134,16 @@ parse_reply(const unsigned char *data, size_t len)
     size = (p[0] << 8) | p[1];
     p += 2;
 
-	if (p + size > end_data) {
+    if (p + size > end_data)
-	    dns_free_data(r);
+	return -1;
-	    return NULL;
-	}
 
-	*rr = (struct resource_record*)calloc(1, 
+    *rr = calloc(1, sizeof(**rr));
-					      sizeof(struct resource_record));
+    if(*rr == NULL) 
-	if(*rr == NULL) {
+	return -1;
-	    dns_free_data(r);
-	    return NULL;
-	}
     (*rr)->domain = strdup(host);
     if((*rr)->domain == NULL) {
-	    dns_free_data(r);
+	free(*rr);
-	    return NULL;
+	return -1;
     }
     (*rr)->type = type;
     (*rr)->class = class;
@@ -204,32 +155,32 @@ parse_reply(const unsigned char *data, size_t len)
     case T_PTR:
 	status = dn_expand(data, end_data, p, host, sizeof(host));
 	if(status < 0) {
-		dns_free_data(r);
+	    free(*rr);
-		return NULL;
+	    return -1;
 	}
 	(*rr)->u.txt = strdup(host);
 	if((*rr)->u.txt == NULL) {
-		dns_free_data(r);
+	    free(*rr);
-		return NULL;
+	    return -1;
 	}
 	break;
     case T_MX:
     case T_AFSDB:{
 	status = dn_expand(data, end_data, p + 2, host, sizeof(host));
 	if(status < 0){
-		dns_free_data(r);
+	    free(*rr);
-		return NULL;
+	    return -1;
 	}
 	if (status + 2 > size) {
-		dns_free_data(r);
+	    free(*rr);
-		return NULL;
+	    return -1;
 	}
 
 	(*rr)->u.mx = (struct mx_record*)malloc(sizeof(struct mx_record) + 
 						strlen(host));
 	if((*rr)->u.mx == NULL) {
-		dns_free_data(r);
+	    free(*rr);
-		return NULL;
+	    return -1;
 	}
 	(*rr)->u.mx->preference = (p[0] << 8) | p[1];
 	strcpy((*rr)->u.mx->domain, host);
@@ -238,20 +189,20 @@ parse_reply(const unsigned char *data, size_t len)
     case T_SRV:{
 	status = dn_expand(data, end_data, p + 6, host, sizeof(host));
 	if(status < 0){
-		dns_free_data(r);
+	    free(*rr);
-		return NULL;
+	    return -1;
 	}
 	if (status + 6 > size) {
-		dns_free_data(r);
+	    free(*rr);
-		return NULL;
+	    return -1;
 	}
 
 	(*rr)->u.srv = 
 	    (struct srv_record*)malloc(sizeof(struct srv_record) + 
 				       strlen(host));
 	if((*rr)->u.srv == NULL) {
-		dns_free_data(r);
+	    free(*rr);
-		return NULL;
+	    return -1;
 	}
 	(*rr)->u.srv->priority = (p[0] << 8) | p[1];
 	(*rr)->u.srv->weight = (p[2] << 8) | p[3];
@@ -260,28 +211,32 @@ parse_reply(const unsigned char *data, size_t len)
 	break;
     }
     case T_TXT:{
-	    (*rr)->u.txt = (char*)malloc(size + 1);
+	if(size == 0 || size < *p + 1) {
+	    free(*rr);
+	    return -1;
+	}
+	(*rr)->u.txt = (char*)malloc(*p + 1);
 	if((*rr)->u.txt == NULL) {
-		dns_free_data(r);
+	    free(*rr);
-		return NULL;
+	    return -1;
 	}
 	strncpy((*rr)->u.txt, (char*)p + 1, *p);
-	    (*rr)->u.txt[*p] = 0;
+	(*rr)->u.txt[*p] = '\0';
 	break;
     }
     case T_KEY : {
 	size_t key_len;
 
 	if (size < 4) {
-		dns_free_data (r);
+	    free(*rr);
-		return NULL;
+	    return -1;
 	}
 
 	key_len = size - 4;
 	(*rr)->u.key = malloc (sizeof(*(*rr)->u.key) + key_len - 1);
 	if ((*rr)->u.key == NULL) {
-		dns_free_data (r);
+	    free(*rr);
-		return NULL;
+	    return -1;
 	}
 
 	(*rr)->u.key->flags     = (p[0] << 8) | p[1];
@@ -294,22 +249,31 @@ parse_reply(const unsigned char *data, size_t len)
     case T_SIG : {
 	size_t sig_len;
 
+	if(size <= 18) {
+	    free(*rr);
+	    return -1;
+	}
 	status = dn_expand (data, end_data, p + 18, host, sizeof(host));
 	if (status < 0) {
-		dns_free_data (r);
+	    free(*rr);
-		return NULL;
+	    return -1;
 	}
 	if (status + 18 > size) {
-		dns_free_data(r);
+	    free(*rr);
-		return NULL;
+	    return -1;
 	}
 
-	    sig_len = len - 18 - status;
+	/* the signer name is placed after the sig_data, to make it
+           easy to free this struture; the size calculation below
+           includes the zero-termination if the structure itself.
+	   don't you just love C?
+	*/
+	sig_len = size - 18 - status;
 	(*rr)->u.sig = malloc(sizeof(*(*rr)->u.sig)
 			      + strlen(host) + sig_len);
 	if ((*rr)->u.sig == NULL) {
-		dns_free_data (r);
+	    free(*rr);
-		return NULL;
+	    return -1;
 	}
 	(*rr)->u.sig->type           = (p[0] << 8) | p[1];
 	(*rr)->u.sig->algorithm      = p[2];
@@ -332,15 +296,15 @@ parse_reply(const unsigned char *data, size_t len)
 	size_t cert_len;
 
 	if (size < 5) {
-		dns_free_data(r);
+	    free(*rr);
-		return NULL;
+	    return -1;
 	}
 
 	cert_len = size - 5;
 	(*rr)->u.cert = malloc (sizeof(*(*rr)->u.cert) + cert_len - 1);
 	if ((*rr)->u.cert == NULL) {
-		dns_free_data (r);
+	    free(*rr);
-		return NULL;
+	    return -1;
 	}
 
 	(*rr)->u.cert->type      = (p[0] << 8) | p[1];
@@ -353,12 +317,86 @@ parse_reply(const unsigned char *data, size_t len)
     default:
 	(*rr)->u.data = (unsigned char*)malloc(size);
 	if(size != 0 && (*rr)->u.data == NULL) {
-		dns_free_data(r);
+	    free(*rr);
-		return NULL;
+	    return -1;
 	}
 	memcpy((*rr)->u.data, p, size);
     }
-	p += size;
+    *pp = p + size;
+    return 0;
+}
+
+#ifndef TEST_RESOLVE
+static
+#endif
+struct dns_reply*
+parse_reply(const unsigned char *data, size_t len)
+{
+    const unsigned char *p;
+    int status;
+    int i;
+    char host[MAXDNAME];
+    const unsigned char *end_data = data + len;
+    struct dns_reply *r;
+    struct resource_record **rr;
+    
+    r = calloc(1, sizeof(*r));
+    if (r == NULL)
+	return NULL;
+
+    p = data;
+#if 0
+    /* doesn't work on Crays */
+    memcpy(&r->h, p, sizeof(HEADER));
+    p += sizeof(HEADER);
+#else
+    memcpy(&r->h, p, 12); /* XXX this will probably be mostly garbage */
+    p += 12;
+#endif
+    if(ntohs(r->h.qdcount) != 1) {
+	free(r);
+	return NULL;
+    }
+    status = dn_expand(data, end_data, p, host, sizeof(host));
+    if(status < 0){
+	dns_free_data(r);
+	return NULL;
+    }
+    r->q.domain = strdup(host);
+    if(r->q.domain == NULL) {
+	dns_free_data(r);
+	return NULL;
+    }
+    if (p + status + 4 > end_data) {
+	dns_free_data(r);
+	return NULL;
+    }
+    p += status;
+    r->q.type = (p[0] << 8 | p[1]);
+    p += 2;
+    r->q.class = (p[0] << 8 | p[1]);
+    p += 2;
+    
+    rr = &r->head;
+    for(i = 0; i < ntohs(r->h.ancount); i++) {
+	if(parse_record(data, end_data, &p, rr) != 0) {
+	    dns_free_data(r);
+	    return NULL;
+	}
+	rr = &(*rr)->next;
+    }
+    for(i = 0; i < ntohs(r->h.nscount); i++) {
+	if(parse_record(data, end_data, &p, rr) != 0) {
+	    dns_free_data(r);
+	    return NULL;
+	}
+	rr = &(*rr)->next;
+    }
+    for(i = 0; i < ntohs(r->h.arcount); i++) {
+	if(parse_record(data, end_data, &p, rr) != 0) {
+	    dns_free_data(r);
+	    return NULL;
+	}
 	rr = &(*rr)->next;
     }
     *rr = NULL;
@@ -566,7 +604,7 @@ main(int argc, char **argv)
 	dns_srv_order(r);
 
     for(rr = r->head; rr;rr=rr->next){
-	printf("%s %s %d ", rr->domain, dns_type_to_string(rr->type), rr->ttl);
+	printf("%-30s %-5s %-6d ", rr->domain, dns_type_to_string(rr->type), rr->ttl);
 	switch(rr->type){
 	case T_NS:
 	case T_CNAME: