Skip to content

Commit

Permalink
Avoid UB when packing a domain name (#1613)
Browse files Browse the repository at this point in the history
rfc1035NamePack() called rfc1035LabelPack() with a nil label buffer.
Feeding memcpy() a nil buffer is undefined behavior, even if size is 0.
  • Loading branch information
jtstrs authored and squid-anubis committed Dec 22, 2023
1 parent 1a848e4 commit 2f204c4
Showing 1 changed file with 10 additions and 5 deletions.
15 changes: 10 additions & 5 deletions src/dns/rfc1035.cc
Original file line number Diff line number Diff line change
Expand Up @@ -100,10 +100,11 @@ rfc1035HeaderPack(char *buf, size_t sz, rfc1035_message * hdr)
static int
rfc1035LabelPack(char *buf, size_t sz, const char *label)
{
assert(label);
assert(!strchr(label, '.'));

int off = 0;
size_t len = label ? strlen(label) : 0;
if (label)
assert(!strchr(label, '.'));
auto len = strlen(label);
if (len > RFC1035_MAXLABELSZ)
len = RFC1035_MAXLABELSZ;
assert(sz >= len + 1);
Expand Down Expand Up @@ -134,8 +135,12 @@ rfc1035NamePack(char *buf, size_t sz, const char *name)
for (t = strtok(copy, "."); t; t = strtok(nullptr, "."))
off += rfc1035LabelPack(buf + off, sz - off, t);
xfree(copy);
off += rfc1035LabelPack(buf + off, sz - off, nullptr);
assert(off <= sz);

// add a terminating root (i.e. zero length) label
assert(off < sz);
buf[off] = 0;
++off;

return off;
}

Expand Down

0 comments on commit 2f204c4

Please sign in to comment.