fix rejection of dns responses with pointers past 512 byte offset

[musl] / src / string / memmem.c

diff --git a/src/string/memmem.c b/src/string/memmem.c
index a5a249f..11eff86 100644 (file)
--- a/src/string/memmem.c
+++ b/src/string/memmem.c
@@ -5,27 +5,27 @@
 static char *twobyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
 {
        uint16_t nw = n[0]<<8 | n[1], hw = h[0]<<8 | h[1];
-       for (h++, k--; k; k--, hw = hw<<8 | *++h)
-               if (hw == nw) return (char *)h-1;
-       return 0;
+       for (h+=2, k-=2; k; k--, hw = hw<<8 | *h++)
+               if (hw == nw) return (char *)h-2;
+       return hw == nw ? (char *)h-2 : 0;
 }
 
 static char *threebyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
 {
-       uint32_t nw = n[0]<<24 | n[1]<<16 | n[2]<<8;
-       uint32_t hw = h[0]<<24 | h[1]<<16 | h[2]<<8;
-       for (h+=2, k-=2; k; k--, hw = (hw|*++h)<<8)
-               if (hw == nw) return (char *)h-2;
-       return 0;
+       uint32_t nw = (uint32_t)n[0]<<24 | n[1]<<16 | n[2]<<8;
+       uint32_t hw = (uint32_t)h[0]<<24 | h[1]<<16 | h[2]<<8;
+       for (h+=3, k-=3; k; k--, hw = (hw|*h++)<<8)
+               if (hw == nw) return (char *)h-3;
+       return hw == nw ? (char *)h-3 : 0;
 }
 
 static char *fourbyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
 {
-       uint32_t nw = n[0]<<24 | n[1]<<16 | n[2]<<8 | n[3];
-       uint32_t hw = h[0]<<24 | h[1]<<16 | h[2]<<8 | h[3];
-       for (h+=3, k-=3; k; k--, hw = hw<<8 | *++h)
-               if (hw == nw) return (char *)h-3;
-       return 0;
+       uint32_t nw = (uint32_t)n[0]<<24 | n[1]<<16 | n[2]<<8 | n[3];
+       uint32_t hw = (uint32_t)h[0]<<24 | h[1]<<16 | h[2]<<8 | h[3];
+       for (h+=4, k-=4; k; k--, hw = hw<<8 | *h++)
+               if (hw == nw) return (char *)h-4;
+       return hw == nw ? (char *)h-4 : 0;
 }
 
 #define MAX(a,b) ((a)>(b)?(a):(b))
@@ -100,7 +100,7 @@ static char *twoway_memmem(const unsigned char *h, const unsigned char *z, const
                if (BITOP(byteset, h[l-1], &)) {
                        k = l-shift[h[l-1]];
                        if (k) {
-                               if (mem0 && mem && k < p) k = l-p;
+                               if (k < mem) k = mem;
                                h += k;
                                mem = 0;
                                continue;
@@ -112,15 +112,15 @@ static char *twoway_memmem(const unsigned char *h, const unsigned char *z, const
                }
 
                /* Compare right half */
-               for (k=MAX(ms+1,mem); n[k] && n[k] == h[k]; k++);
-               if (n[k]) {
+               for (k=MAX(ms+1,mem); k<l && n[k] == h[k]; k++);
+               if (k < l) {
                        h += k-ms;
                        mem = 0;
                        continue;
                }
                /* Compare left half */
                for (k=ms+1; k>mem && n[k-1] == h[k-1]; k--);
-               if (k == mem) return (char *)h;
+               if (k <= mem) return (char *)h;
                h += p;
                mem = mem0;
        }
@@ -140,6 +140,7 @@ void *memmem(const void *h0, size_t k, const void *n0, size_t l)
        h = memchr(h0, *n, k);
        if (!h || l==1) return (void *)h;
        k -= h - (const unsigned char *)h0;
+       if (k<l) return 0;
        if (l==2) return twobyte_memmem(h, k, n);
        if (l==3) return threebyte_memmem(h, k, n);
        if (l==4) return fourbyte_memmem(h, k, n);