Browse Source

Do not follow compressed items forever.

It is possible to get stuck in an infinite loop when receiving a
specially crafted DNS reply. Exit the loop after a number of iteration
and consider the packet invalid.

Signed-off-by: Daniel Fahlgren <daniel@fahlgren.se>
Signed-off-by: Waldemar Brodkorb <wbx@uclibc-ng.org>
Waldemar Brodkorb 9 years ago
parent
commit
d9c3a16dca
1 changed files with 4 additions and 1 deletions
  1. 4 1
      libc/inet/resolv.c

+ 4 - 1
libc/inet/resolv.c

@@ -669,11 +669,12 @@ int __decode_dotted(const unsigned char *packet,
 	bool measure = 1;
 	unsigned total = 0;
 	unsigned used = 0;
+	unsigned maxiter = 256;
 
 	if (!packet)
 		return -1;
 
-	while (1) {
+	while (--maxiter) {
 		if (offset >= packet_len)
 			return -1;
 		b = packet[offset++];
@@ -710,6 +711,8 @@ int __decode_dotted(const unsigned char *packet,
 		else
 			dest[used++] = '\0';
 	}
+	if (!maxiter)
+		return -1;
 
 	/* The null byte must be counted too */
 	if (measure)