in dns parsing callback, enforce MAXADDRS to preclude overflow

[musl] / src / network / lookup_name.c

diff --git a/src/network/lookup_name.c b/src/network/lookup_name.c
index 86f90ac..209c20f 100644 (file)
--- a/src/network/lookup_name.c
+++ b/src/network/lookup_name.c
@@ -111,6 +111,7 @@ static int dns_parse_callback(void *c, int rr, const void *data, int len, const
 {
        char tmp[256];
        struct dpc_ctx *ctx = c;
+       if (ctx->cnt >= MAXADDRS) return -1;
        switch (rr) {
        case RR_A:
                if (len != 4) return -1;
@@ -141,16 +142,19 @@ static int name_from_dns(struct address buf[static MAXADDRS], char canon[static
        int qlens[2], alens[2];
        int i, nq = 0;
        struct dpc_ctx ctx = { .addrs = buf, .canon = canon };
-
-       if (family != AF_INET6) {
-               qlens[nq] = __res_mkquery(0, name, 1, RR_A, 0, 0, 0,
-                       qbuf[nq], sizeof *qbuf);
-               nq++;
-       }
-       if (family != AF_INET) {
-               qlens[nq] = __res_mkquery(0, name, 1, RR_AAAA, 0, 0, 0,
-                       qbuf[nq], sizeof *qbuf);
-               nq++;
+       static const struct { int af; int rr; } afrr[2] = {
+               { .af = AF_INET6, .rr = RR_A },
+               { .af = AF_INET, .rr = RR_AAAA },
+       };
+
+       for (i=0; i<2; i++) {
+               if (family != afrr[i].af) {
+                       qlens[nq] = __res_mkquery(0, name, 1, afrr[i].rr,
+                               0, 0, 0, qbuf[nq], sizeof *qbuf);
+                       if (qlens[nq] == -1)
+                               return EAI_NONAME;
+                       nq++;
+               }
        }
 
        if (__res_msend_rc(nq, qp, qlens, ap, alens, sizeof *abuf, conf) < 0)
@@ -335,8 +339,8 @@ int __lookup_name(struct address buf[static MAXADDRS], char canon[static 256], c
        /* No further processing is needed if there are fewer than 2
         * results or if there are only IPv4 results. */
        if (cnt<2 || family==AF_INET) return cnt;
-       for (i=0; buf[i].family == AF_INET; i++)
-               if (i==cnt) return cnt;
+       for (i=0; i<cnt; i++) if (buf[i].family != AF_INET) break;
+       if (i==cnt) return cnt;
 
        int cs;
        pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);