romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 20:23:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

doh: fix (harmless) buffer overrun

Browse source 
Added unit test case 1655 to verify.
Close #4352

the code correctly finds the flaws in the old code,
if one temporarily restores doh.c to the old version.
This commit is contained in:
Paul Dreik 2019-09-14 03:16:09 +02:00 • committed by Daniel Stenberg
parent 5eb75d4186
commit b766602729
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
7 changed files with 163 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

17
lib/doh.c
View file

@ -74,17 +74,26 @@ static const char *doh_strerror(DOHcode code)
#define UNITTEST static
#endif
/* @unittest 1655
*/
UNITTEST DOHcode doh_encode(const char *host,
DNStype dnstype,
unsigned char *dnsp, /* buffer */
size_t len, /* buffer size */
size_t *olen) /* output length */
{
size_t hostlen = strlen(host);
const size_t hostlen = strlen(host);
unsigned char *orig = dnsp;
const char *hostp = host;
if(len < (12 + hostlen + 4))
/* The expected output length does not depend on the number of dots within
* the host name. It will always be two more than the length of the host
* name, one for the size and one trailing null. In case there are dots,
* each dot adds one size but removes the need to store the dot, net zero.
*/
const size_t expected_len = 12 + ( 1 + hostlen + 1) + 4;
if(len < expected_len)
return DOH_TOO_SMALL_BUFFER;
*dnsp++ = 0; /* 16 bit id */
@ -132,6 +141,10 @@ UNITTEST DOHcode doh_encode(const char *host,
*dnsp++ = DNS_CLASS_IN; /* IN - "the Internet" */
*olen = dnsp - orig;
/* verify that our assumption of length is valid, since
* this has lead to buffer overflows in this function */
DEBUGASSERT(*olen == expected_len);
return DOH_OK;
}