diff options
| author | Stanisław Pitucha <viraptor@gmail.com> | 2014-11-18 16:25:20 +1100 |
|---|---|---|
| committer | David Herrmann <dh.herrmann@gmail.com> | 2014-11-27 16:35:56 +0100 |
| commit | c75dbf9bea577057c5a6ee3d52db6e13aa6caa57 (patch) | |
| tree | 05b979b3a0e7f03851528404abaf284b711f45d5 /src/resolve | |
| parent | c21b92ffe7ef939dd32502ac912cf8ad1c5638fd (diff) | |
resolve: fix redirection loops in compressed RR
Loops in RR compression were only detected for the first entry.
Multiple redirections should be allowed, each one checking for an
infinite loop on its own starting point.
Also update the pointer on each redirection to avoid longer loops of
labels and redirections, in names like:
(start) [len=1] "A", [ptr to start]
(David: rename variable to "jump_barrier" and add reference to RFC)
Diffstat (limited to 'src/resolve')
| -rw-r--r-- | src/resolve/resolved-dns-packet.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c index e5d07b3b1..2afb8d05d 100644 --- a/src/resolve/resolved-dns-packet.c +++ b/src/resolve/resolved-dns-packet.c @@ -860,7 +860,7 @@ fail: int dns_packet_read_name(DnsPacket *p, char **_ret, bool allow_compression, size_t *start) { - size_t saved_rindex, after_rindex = 0; + size_t saved_rindex, after_rindex = 0, jump_barrier; _cleanup_free_ char *ret = NULL; size_t n = 0, allocated = 0; bool first = true; @@ -870,6 +870,7 @@ int dns_packet_read_name(DnsPacket *p, char **_ret, assert(_ret); saved_rindex = p->rindex; + jump_barrier = p->rindex; for (;;) { uint8_t c, d; @@ -916,7 +917,7 @@ int dns_packet_read_name(DnsPacket *p, char **_ret, goto fail; ptr = (uint16_t) (c & ~0xc0) << 8 | (uint16_t) d; - if (ptr < DNS_PACKET_HEADER_SIZE || ptr >= saved_rindex) { + if (ptr < DNS_PACKET_HEADER_SIZE || ptr >= jump_barrier) { r = -EBADMSG; goto fail; } @@ -924,6 +925,8 @@ int dns_packet_read_name(DnsPacket *p, char **_ret, if (after_rindex == 0) after_rindex = p->rindex; + /* Jumps are limited to a "prior occurence" (RFC-1035 4.1.4) */ + jump_barrier = ptr; p->rindex = ptr; } else goto fail; |