Security fixes

This commit is contained in:
Erik Ekman 2006-09-11 19:07:51 +00:00
parent daae2aa9f0
commit 69c8b05a2c
2 changed files with 7 additions and 6 deletions

11
dns.c
View File

@ -324,8 +324,8 @@ dns_parse_reply(char *outbuf, int buflen, char *packet, int packetlen)
} }
if(type == T_NULL && rlen > 2) { if(type == T_NULL && rlen > 2) {
memcpy(outbuf, rdata, rlen); rv = MIN(rlen, sizeof(rdata));
rv = rlen; memcpy(outbuf, rdata, rv);
} }
} }
@ -429,7 +429,7 @@ dnsd_read(int fd, struct query *q, char *buf, int buflen)
short class; short class;
short qdcount; short qdcount;
char *data; char *data;
char name[255]; char name[257];
HEADER *header; HEADER *header;
socklen_t addrlen; socklen_t addrlen;
char packet[64*1024]; char packet[64*1024];
@ -449,11 +449,12 @@ dnsd_read(int fd, struct query *q, char *buf, int buflen)
qdcount = ntohs(header->qdcount); qdcount = ntohs(header->qdcount);
if(qdcount == 1) { if(qdcount == 1) {
readname(packet, &data, name, sizeof(name)); readname(packet, &data, name, sizeof(name) -1);
name[256] = 0;
readshort(packet, &data, &type); readshort(packet, &data, &type);
readshort(packet, &data, &class); readshort(packet, &data, &class);
strncpy(q->name, name, 256); strncpy(q->name, name, 257);
q->type = type; q->type = type;
q->id = id; q->id = id;
q->fromlen = addrlen; q->fromlen = addrlen;

View File

@ -25,7 +25,7 @@ struct packet
}; };
struct query { struct query {
char name[256]; char name[258];
short type; short type;
short id; short id;
struct sockaddr from; struct sockaddr from;