Index: bind8/src/lib/irs/dns_ho.c
diff -c bind8/src/lib/irs/dns_ho.c:1.36 bind8/src/lib/irs/dns_ho.c:1.39
*** bind8/src/lib/irs/dns_ho.c:1.36	Thu May 30 23:05:30 2002
--- bind8/src/lib/irs/dns_ho.c	Wed Jun 26 20:56:32 2002
***************
*** 74,79 ****
--- 74,80 ----
  #include <resolv.h>
  #include <stdio.h>
  #include <string.h>
+ #include <syslog.h>
  
  #include <isc/memcluster.h>
  #include <irs.h>
***************
*** 161,167 ****
  				     const struct addrinfo *pai);
  
  static void		map_v4v6_hostent(struct hostent *hp, char **bp,
! 					 int *len);
  static void		addrsort(res_state, char **, int);
  static struct hostent *	gethostans(struct irs_ho *this,
  				   const u_char *ansbuf, int anslen,
--- 162,168 ----
  				     const struct addrinfo *pai);
  
  static void		map_v4v6_hostent(struct hostent *hp, char **bp,
! 					 char *ep);
  static void		addrsort(res_state, char **, int);
  static struct hostent *	gethostans(struct irs_ho *this,
  				   const u_char *ansbuf, int anslen,
***************
*** 1079,1085 ****
  	   struct addrinfo **ret_aip, const struct addrinfo *pai)
  {
  	struct pvt *pvt = (struct pvt *)this->private;
! 	int type, class, buflen, ancount, qdcount, n, haveanswer, had_error;
  	int error = NETDB_SUCCESS, arcount;
  	int (*name_ok)(const char *);
  	const HEADER *hp;
--- 1080,1086 ----
  	   struct addrinfo **ret_aip, const struct addrinfo *pai)
  {
  	struct pvt *pvt = (struct pvt *)this->private;
! 	int type, class, ancount, qdcount, n, haveanswer, had_error;
  	int error = NETDB_SUCCESS, arcount;
  	int (*name_ok)(const char *);
  	const HEADER *hp;
***************
*** 1088,1094 ****
  	const u_char *cp;
  	const char *tname;
  	const char *hname;
! 	char *bp, **ap, **hap;
  	char tbuf[MAXDNAME+1];
  	struct addrinfo sentinel, *cur, ai;
  	const u_char *arp = NULL;
--- 1089,1095 ----
  	const u_char *cp;
  	const char *tname;
  	const char *hname;
! 	char *bp, *ep, **ap, **hap;
  	char tbuf[MAXDNAME+1];
  	struct addrinfo sentinel, *cur, ai;
  	const u_char *arp = NULL;
***************
*** 1131,1143 ****
  	qdcount = ntohs(hp->qdcount);
  	arcount = ntohs(hp->arcount);
  	bp = pvt->hostbuf;
! 	buflen = sizeof pvt->hostbuf;
  	cp = ansbuf + HFIXEDSZ;
  	if (qdcount != 1) {
  		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
  		return (NULL);
  	}
! 	n = dn_expand(ansbuf, eom, cp, bp, buflen);
  	if (n < 0 || !maybe_ok(pvt->res, bp, name_ok)) {
  		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
  		return (NULL);
--- 1132,1144 ----
  	qdcount = ntohs(hp->qdcount);
  	arcount = ntohs(hp->arcount);
  	bp = pvt->hostbuf;
! 	ep = pvt->hostbuf + sizeof(pvt->hostbuf);
  	cp = ansbuf + HFIXEDSZ;
  	if (qdcount != 1) {
  		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
  		return (NULL);
  	}
! 	n = dn_expand(ansbuf, eom, cp, bp, ep - bp);
  	if (n < 0 || !maybe_ok(pvt->res, bp, name_ok)) {
  		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
  		return (NULL);
***************
*** 1161,1167 ****
  		pvt->host.h_name = bp;
  		hname = bp;
  		bp += n;
- 		buflen -= n;
  		/* The qname can be abbreviated, but hname is now absolute. */
  		qname = pvt->host.h_name;
  	}
--- 1162,1167 ----
***************
*** 1174,1180 ****
  	haveanswer = 0;
  	had_error = 0;
  	while (ancount-- > 0 && cp < eom && !had_error) {
! 		n = dn_expand(ansbuf, eom, cp, bp, buflen);
  		if (n < 0 || !maybe_ok(pvt->res, bp, name_ok)) {
  			had_error++;
  			continue;
--- 1174,1180 ----
  	haveanswer = 0;
  	had_error = 0;
  	while (ancount-- > 0 && cp < eom && !had_error) {
! 		n = dn_expand(ansbuf, eom, cp, bp, ep - bp);
  		if (n < 0 || !maybe_ok(pvt->res, bp, name_ok)) {
  			had_error++;
  			continue;
***************
*** 1195,1200 ****
--- 1195,1209 ----
  		eor = cp + n;
  		if ((qtype == T_A || qtype == T_AAAA || qtype == ns_t_a6 ||
  		     qtype == T_ANY) && type == T_CNAME) {
+ 			if (haveanswer) {
+ 				int level = LOG_CRIT;
+ #ifdef LOG_SECURITY
+ 				level |= LOG_SECURITY;
+ #endif
+ 				syslog(level,
+  "gethostans: possible attempt to exploit buffer overflow while looking up %s",
+ 					*qname ? qname : ".");
+ 			}
  			if (ap >= &pvt->host_aliases[MAXALIASES-1])
  				continue;
  			n = dn_expand(ansbuf, eor, cp, tbuf, sizeof tbuf);
***************
*** 1207,1216 ****
  			*ap++ = bp;
  			n = strlen(bp) + 1;	/* for the \0 */
  			bp += n;
- 			buflen -= n;
  			/* Get canonical name. */
  			n = strlen(tbuf) + 1;	/* for the \0 */
! 			if (n > buflen || n > MAXHOSTNAMELEN) {
  				had_error++;
  				continue;
  			}
--- 1216,1224 ----
  			*ap++ = bp;
  			n = strlen(bp) + 1;	/* for the \0 */
  			bp += n;
  			/* Get canonical name. */
  			n = strlen(tbuf) + 1;	/* for the \0 */
! 			if (n > (ep - bp) || n > MAXHOSTNAMELEN) {
  				had_error++;
  				continue;
  			}
***************
*** 1218,1224 ****
  			pvt->host.h_name = bp;
  			hname = bp;
  			bp += n;
- 			buflen -= n;
  			continue;
  		}
  		if (type == ns_t_dname) {
--- 1226,1231 ----
***************
*** 1254,1260 ****
  			cp += n;
  
  			n = strlen(t) + 1; /* for the \0 */
! 			if (n > buflen) {
  				had_error++;
  				continue;
  			}
--- 1261,1267 ----
  			cp += n;
  
  			n = strlen(t) + 1; /* for the \0 */
! 			if (n > (ep - bp)) {
  				had_error++;
  				continue;
  			}
***************
*** 1264,1270 ****
  			else
  				hname = bp;
  			bp += n;
- 			buflen -= n;
  
  			continue;
  		}
--- 1271,1276 ----
***************
*** 1290,1303 ****
  			}
  			/* Get canonical name. */
  			n = strlen(tbuf) + 1;	/* for the \0 */
! 			if (n > buflen) {
  				had_error++;
  				continue;
  			}
  			strcpy(bp, tbuf);
  			tname = bp;
  			bp += n;
- 			buflen -= n;
  			continue;
  		}
  		if (qtype == T_ANY) {
--- 1296,1308 ----
  			}
  			/* Get canonical name. */
  			n = strlen(tbuf) + 1;	/* for the \0 */
! 			if (n > (ep - bp)) {
  				had_error++;
  				continue;
  			}
  			strcpy(bp, tbuf);
  			tname = bp;
  			bp += n;
  			continue;
  		}
  		if (qtype == T_ANY) {
***************
*** 1321,1327 ****
  				cp += n;
  				continue;
  			}
! 			n = dn_expand(ansbuf, eor, cp, bp, buflen);
  			if (n < 0 || !maybe_hnok(pvt->res, bp) ||
  			    n >= MAXHOSTNAMELEN) {
  				had_error++;
--- 1326,1332 ----
  				cp += n;
  				continue;
  			}
! 			n = dn_expand(ansbuf, eor, cp, bp, ep - bp);
  			if (n < 0 || !maybe_hnok(pvt->res, bp) ||
  			    n >= MAXHOSTNAMELEN) {
  				had_error++;
***************
*** 1339,1345 ****
  			if (n != -1) {
  				n = strlen(bp) + 1;	/* for the \0 */
  				bp += n;
- 				buflen -= n;
  			}
  			break;
  		case ns_t_a6: {
--- 1344,1349 ----
***************
*** 1439,1445 ****
  				pvt->host.h_name = bp;
  				hname = bp;
  				bp += nn;
- 				buflen -= nn;
  			}
  			/* Ensure alignment. */
  			bp = (char *)(((u_long)bp + (sizeof(align) - 1)) &
--- 1443,1448 ----
***************
*** 1493,1507 ****
  					 haveanswer);
  			if (pvt->host.h_name == NULL) {
  				n = strlen(qname) + 1;	/* for the \0 */
! 				if (n > buflen || n >= MAXHOSTNAMELEN)
  					goto no_recovery;
  				strcpy(bp, qname);
  				pvt->host.h_name = bp;
  				bp += n;
- 				buflen -= n;
  			}
  			if (pvt->res->options & RES_USE_INET6)
! 				map_v4v6_hostent(&pvt->host, &bp, &buflen);
  			RES_SET_H_ERRNO(pvt->res, NETDB_SUCCESS);
  			return (&pvt->host);
  		} else {
--- 1496,1509 ----
  					 haveanswer);
  			if (pvt->host.h_name == NULL) {
  				n = strlen(qname) + 1;	/* for the \0 */
! 				if (n > (ep - bp) || n >= MAXHOSTNAMELEN)
  					goto no_recovery;
  				strcpy(bp, qname);
  				pvt->host.h_name = bp;
  				bp += n;
  			}
  			if (pvt->res->options & RES_USE_INET6)
! 				map_v4v6_hostent(&pvt->host, &bp, ep);
  			RES_SET_H_ERRNO(pvt->res, NETDB_SUCCESS);
  			return (&pvt->host);
  		} else {
***************
*** 1575,1581 ****
  }
  
  static void
! map_v4v6_hostent(struct hostent *hp, char **bpp, int *lenp) {
  	char **ap;
  
  	if (hp->h_addrtype != AF_INET || hp->h_length != INADDRSZ)
--- 1577,1583 ----
  }
  
  static void
! map_v4v6_hostent(struct hostent *hp, char **bpp, char *ep) {
  	char **ap;
  
  	if (hp->h_addrtype != AF_INET || hp->h_length != INADDRSZ)
***************
*** 1588,1604 ****
  		if (i != 0)
  			i = sizeof(align) - i;
  
! 		if (*lenp < (i + IN6ADDRSZ)) {
  			/* Out of memory.  Truncate address list here. */
  			*ap = NULL;
  			return;
  		}
  		*bpp += i;
- 		*lenp -= i;
  		map_v4v6_address(*ap, *bpp);
  		*ap = *bpp;
  		*bpp += IN6ADDRSZ;
- 		*lenp -= IN6ADDRSZ;
  	}
  }
  
--- 1590,1604 ----
  		if (i != 0)
  			i = sizeof(align) - i;
  
! 		if ((ep - *bpp) < (i + IN6ADDRSZ)) {
  			/* Out of memory.  Truncate address list here. */
  			*ap = NULL;
  			return;
  		}
  		*bpp += i;
  		map_v4v6_address(*ap, *bpp);
  		*ap = *bpp;
  		*bpp += IN6ADDRSZ;
  	}
  }
  
Index: bind8/src/lib/irs/dns_nw.c
diff -c bind8/src/lib/irs/dns_nw.c:1.22 bind8/src/lib/irs/dns_nw.c:1.23
*** bind8/src/lib/irs/dns_nw.c:1.22	Tue Feb 26 19:50:10 2002
--- bind8/src/lib/irs/dns_nw.c	Wed Jun 26 00:42:06 2002
***************
*** 299,306 ****
  	      int af, const char *name, const u_char *addr, int addrlen)
  {
  	struct pvt *pvt = (struct pvt *)this->private;
! 	int type, class, buflen, ancount, qdcount, haveanswer;
! 	char *bp, **ap;
  	u_char *cp, *eom;
  	HEADER *hp;
  
--- 299,306 ----
  	      int af, const char *name, const u_char *addr, int addrlen)
  {
  	struct pvt *pvt = (struct pvt *)this->private;
! 	int type, class, ancount, qdcount, haveanswer;
! 	char *bp, *ep, **ap;
  	u_char *cp, *eom;
  	HEADER *hp;
  
***************
*** 332,338 ****
  
  	/* Prepare a return structure. */
  	bp = pvt->buf;
! 	buflen = sizeof pvt->buf;
  	pvt->net.n_name = NULL;
  	pvt->net.n_aliases = pvt->ali;
  	pvt->net.n_addrtype = af;
--- 332,338 ----
  
  	/* Prepare a return structure. */
  	bp = pvt->buf;
! 	ep = pvt->buf + sizeof(pvt->buf);
  	pvt->net.n_name = NULL;
  	pvt->net.n_aliases = pvt->ali;
  	pvt->net.n_addrtype = af;
***************
*** 345,364 ****
  		if (name != NULL) {
  			int n = strlen(name) + 1;
  
! 			if (n > buflen) {
  				RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
  				return (NULL);
  			}
  			pvt->net.n_name = strcpy(bp, name);
  			bp += n;
- 			buflen -= n;
  		}
  		break;
  	case by_addr:
  		if (addr != NULL && addrlen != 0) {
  			int n = addrlen / 8 + ((addrlen % 8) != 0);
  
! 			if (INADDRSZ > buflen) {
  				RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
  				return (NULL);
  			}
--- 345,363 ----
  		if (name != NULL) {
  			int n = strlen(name) + 1;
  
! 			if (n > (ep - bp)) {
  				RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
  				return (NULL);
  			}
  			pvt->net.n_name = strcpy(bp, name);
  			bp += n;
  		}
  		break;
  	case by_addr:
  		if (addr != NULL && addrlen != 0) {
  			int n = addrlen / 8 + ((addrlen % 8) != 0);
  
! 			if (INADDRSZ > (ep - bp)) {
  				RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
  				return (NULL);
  			}
***************
*** 366,372 ****
  			memcpy(bp, addr, n);
  			pvt->net.n_addr = bp;
  			bp += INADDRSZ;
- 			buflen -= INADDRSZ;
  		}
  		break;
  	default:
--- 365,370 ----
***************
*** 377,383 ****
  	ap = pvt->ali;
  	haveanswer = 0;
  	while (--ancount >= 0 && cp < eom) {
! 		int n = dn_expand(ansbuf, eom, cp, bp, buflen);
  
  		cp += n;		/* Owner */
  		if (n < 0 || !maybe_dnok(pvt->res, bp) ||
--- 375,381 ----
  	ap = pvt->ali;
  	haveanswer = 0;
  	while (--ancount >= 0 && cp < eom) {
! 		int n = dn_expand(ansbuf, eom, cp, bp, ep - bp);
  
  		cp += n;		/* Owner */
  		if (n < 0 || !maybe_dnok(pvt->res, bp) ||
***************
*** 392,398 ****
  		if (class == C_IN && type == T_PTR) {
  			int nn;
  
! 			nn = dn_expand(ansbuf, eom, cp, bp, buflen);
  			if (nn < 0 || !maybe_hnok(pvt->res, bp) || nn != n) {
  				RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
  				return (NULL);
--- 390,396 ----
  		if (class == C_IN && type == T_PTR) {
  			int nn;
  
! 			nn = dn_expand(ansbuf, eom, cp, bp, ep - bp);
  			if (nn < 0 || !maybe_hnok(pvt->res, bp) || nn != n) {
  				RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
  				return (NULL);
***************
*** 408,414 ****
  					*ap++ = bp;
  				nn = strlen(bp) + 1;
  				bp += nn;
- 				buflen -= nn;
  				haveanswer++;
  				break;
  			    }
--- 406,411 ----
***************
*** 419,425 ****
  				    sscanf(bp, "%u.%u.%u.%u.in-addr.arpa",
  					   &b1, &b2, &b3, &b4) != 4)
  					break;
! 				if (buflen < INADDRSZ) {
  					RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
  					return (NULL);
  				}
--- 416,422 ----
  				    sscanf(bp, "%u.%u.%u.%u.in-addr.arpa",
  					   &b1, &b2, &b3, &b4) != 4)
  					break;
! 				if ((ep - bp) < INADDRSZ) {
  					RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
  					return (NULL);
  				}
***************
*** 428,434 ****
  				*bp++ = b3;
  				*bp++ = b2;
  				*bp++ = b1;
- 				buflen -= INADDRSZ;
  				pvt->net.n_length = INADDRSZ * 8;
  				haveanswer++;
  			    }
--- 425,430 ----