diff options
| author | Nick Mathewson <nickm@torproject.org> | 2007-01-21 17:05:10 +0000 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2007-01-21 17:05:10 +0000 |
| commit | ff62a4d91b82b3aa0c0543529322bc1578a59220 (patch) | |
| tree | 8fe944fa3dd6933a46ed9206a3e7d46051ca9b3e /src/or/eventdns.c | |
| parent | bcbd289af586af7fbc1c28a621988b09a60b913b (diff) | |
| download | tor-ff62a4d91b82b3aa0c0543529322bc1578a59220.tar.gz tor-ff62a4d91b82b3aa0c0543529322bc1578a59220.zip | |
r9692@catbus: nickm | 2007-01-21 12:04:22 -0500
Detect pointer loops in DNS requests and replies; avoid infinite loop on such malformed replies. Fixes bug 380.
svn:r9378
Diffstat (limited to 'src/or/eventdns.c')
| -rw-r--r-- | src/or/eventdns.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/or/eventdns.c b/src/or/eventdns.c index 35efbff00a..e123592e01 100644 --- a/src/or/eventdns.c +++ b/src/or/eventdns.c @@ -736,6 +736,7 @@ static inline int name_parse(u8 *packet, int length, int *idx, char *name_out, int name_out_len) { int name_end = -1; int j = *idx; + int ptr_count = 0; #define GET32(x) do { if (j + 4 > length) goto err; memcpy(&_t32, packet + j, 4); j += 4; x = ntohl(_t32); } while(0); #define GET16(x) do { if (j + 2 > length) goto err; memcpy(&_t, packet + j, 2); j += 2; x = ntohs(_t); } while(0); #define GET8(x) do { if (j >= length) goto err; x = packet[j++]; } while(0); @@ -759,7 +760,11 @@ name_parse(u8 *packet, int length, int *idx, char *name_out, int name_out_len) { GET8(ptr_low); if (name_end < 0) name_end = j; j = (((int)label_len & 0x3f) << 8) + ptr_low; + /* Make sure that the target offset is in-bounds. */ if (j < 0 || j >= length) return -1; + /* If we've jumped more times than there are characters in the + * message, we must have a loop. */ + if (++ptr_count > length) return -1; continue; } if (label_len > 63) return -1; |