fix rejection of dns responses with pointers past 512 byte offset

[musl] / src / string / memmem.c

diff --git a/src/string/memmem.c b/src/string/memmem.c
index d7e1221..11eff86 100644 (file)
--- a/src/string/memmem.c
+++ b/src/string/memmem.c
@@ -5,27 +5,27 @@
 static char *twobyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
 {
        uint16_t nw = n[0]<<8 | n[1], hw = h[0]<<8 | h[1];
-       for (h++, k--; k; k--, hw = hw<<8 | *++h)
-               if (hw == nw) return (char *)h-1;
-       return 0;
+       for (h+=2, k-=2; k; k--, hw = hw<<8 | *h++)
+               if (hw == nw) return (char *)h-2;
+       return hw == nw ? (char *)h-2 : 0;
 }
 
 static char *threebyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
 {
-       uint32_t nw = n[0]<<24 | n[1]<<16 | n[2]<<8;
-       uint32_t hw = h[0]<<24 | h[1]<<16 | h[2]<<8;
-       for (h+=2, k-=2; k; k--, hw = (hw|*++h)<<8)
-               if (hw == nw) return (char *)h-2;
-       return 0;
+       uint32_t nw = (uint32_t)n[0]<<24 | n[1]<<16 | n[2]<<8;
+       uint32_t hw = (uint32_t)h[0]<<24 | h[1]<<16 | h[2]<<8;
+       for (h+=3, k-=3; k; k--, hw = (hw|*h++)<<8)
+               if (hw == nw) return (char *)h-3;
+       return hw == nw ? (char *)h-3 : 0;
 }
 
 static char *fourbyte_memmem(const unsigned char *h, size_t k, const unsigned char *n)
 {
-       uint32_t nw = n[0]<<24 | n[1]<<16 | n[2]<<8 | n[3];
-       uint32_t hw = h[0]<<24 | h[1]<<16 | h[2]<<8 | h[3];
-       for (h+=3, k-=3; k; k--, hw = hw<<8 | *++h)
-               if (hw == nw) return (char *)h-3;
-       return 0;
+       uint32_t nw = (uint32_t)n[0]<<24 | n[1]<<16 | n[2]<<8 | n[3];
+       uint32_t hw = (uint32_t)h[0]<<24 | h[1]<<16 | h[2]<<8 | h[3];
+       for (h+=4, k-=4; k; k--, hw = hw<<8 | *h++)
+               if (hw == nw) return (char *)h-4;
+       return hw == nw ? (char *)h-4 : 0;
 }
 
 #define MAX(a,b) ((a)>(b)?(a):(b))
@@ -100,7 +100,7 @@ static char *twoway_memmem(const unsigned char *h, const unsigned char *z, const
                if (BITOP(byteset, h[l-1], &)) {
                        k = l-shift[h[l-1]];
                        if (k) {
-                               if (mem0 && mem && k < p) k = l-p;
+                               if (k < mem) k = mem;
                                h += k;
                                mem = 0;
                                continue;
@@ -140,6 +140,7 @@ void *memmem(const void *h0, size_t k, const void *n0, size_t l)
        h = memchr(h0, *n, k);
        if (!h || l==1) return (void *)h;
        k -= h - (const unsigned char *)h0;
+       if (k<l) return 0;
        if (l==2) return twobyte_memmem(h, k, n);
        if (l==3) return threebyte_memmem(h, k, n);
        if (l==4) return fourbyte_memmem(h, k, n);