X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fresolve%2Fresolved-dns-packet.c;h=a9bd8b13988dc31d6e5641921097be38fc3d6e08;hp=7375f77481d427cb4769da98372eb67a96e3291b;hb=56f64d95763a799ba4475daf44d8e9f72a1bd474;hpb=d5099efc47d4e6ac60816b5381a5f607ab03f06e

diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
index 7375f7748..a9bd8b139 100644
--- a/src/resolve/resolved-dns-packet.c
+++ b/src/resolve/resolved-dns-packet.c
@@ -22,6 +22,7 @@
 #include "utf8.h"
 #include "util.h"
 #include "strv.h"
+#include "unaligned.h"
 #include "resolved-dns-domain.h"
 #include "resolved-dns-packet.h"
 
@@ -311,8 +312,7 @@ int dns_packet_append_uint16(DnsPacket *p, uint16_t v, size_t *start) {
         if (r < 0)
                 return r;
 
-        ((uint8_t*) d)[0] = (uint8_t) (v >> 8);
-        ((uint8_t*) d)[1] = (uint8_t) v;
+        unaligned_write_be16(d, v);
 
         return 0;
 }
@@ -327,10 +327,7 @@ int dns_packet_append_uint32(DnsPacket *p, uint32_t v, size_t *start) {
         if (r < 0)
                 return r;
 
-        ((uint8_t*) d)[0] = (uint8_t) (v >> 24);
-        ((uint8_t*) d)[1] = (uint8_t) (v >> 16);
-        ((uint8_t*) d)[2] = (uint8_t) (v >> 8);
-        ((uint8_t*) d)[3] = (uint8_t) v;
+        unaligned_write_be32(d, v);
 
         return 0;
 }
@@ -793,8 +790,8 @@ int dns_packet_read_uint16(DnsPacket *p, uint16_t *ret, size_t *start) {
         if (r < 0)
                 return r;
 
-        *ret = (((uint16_t) ((uint8_t*) d)[0]) << 8) |
-                ((uint16_t) ((uint8_t*) d)[1]);
+        *ret = unaligned_read_be16(d);
+
         return 0;
 }
 
@@ -808,10 +805,7 @@ int dns_packet_read_uint32(DnsPacket *p, uint32_t *ret, size_t *start) {
         if (r < 0)
                 return r;
 
-        *ret = (((uint32_t) ((uint8_t*) d)[0]) << 24) |
-               (((uint32_t) ((uint8_t*) d)[1]) << 16) |
-               (((uint32_t) ((uint8_t*) d)[2]) << 8) |
-                ((uint32_t) ((uint8_t*) d)[3]);
+        *ret = unaligned_read_be32(d);
 
         return 0;
 }
@@ -866,7 +860,7 @@ fail:
 
 int dns_packet_read_name(DnsPacket *p, char **_ret,
                          bool allow_compression, size_t *start) {
-        size_t saved_rindex, after_rindex = 0;
+        size_t saved_rindex, after_rindex = 0, jump_barrier;
         _cleanup_free_ char *ret = NULL;
         size_t n = 0, allocated = 0;
         bool first = true;
@@ -876,6 +870,7 @@ int dns_packet_read_name(DnsPacket *p, char **_ret,
         assert(_ret);
 
         saved_rindex = p->rindex;
+        jump_barrier = p->rindex;
 
         for (;;) {
                 uint8_t c, d;
@@ -922,7 +917,7 @@ int dns_packet_read_name(DnsPacket *p, char **_ret,
                                 goto fail;
 
                         ptr = (uint16_t) (c & ~0xc0) << 8 | (uint16_t) d;
-                        if (ptr < DNS_PACKET_HEADER_SIZE || ptr >= saved_rindex) {
+                        if (ptr < DNS_PACKET_HEADER_SIZE || ptr >= jump_barrier) {
                                 r = -EBADMSG;
                                 goto fail;
                         }
@@ -930,9 +925,13 @@ int dns_packet_read_name(DnsPacket *p, char **_ret,
                         if (after_rindex == 0)
                                 after_rindex = p->rindex;
 
+                        /* Jumps are limited to a "prior occurence" (RFC-1035 4.1.4) */
+                        jump_barrier = ptr;
                         p->rindex = ptr;
-                } else
+                } else {
+                        r = -EBADMSG;
                         goto fail;
+                }
         }
 
         if (!GREEDY_REALLOC(ret, allocated, n + 1)) {
@@ -1115,6 +1114,13 @@ int dns_packet_read_rr(DnsPacket *p, DnsResourceRecord **ret, size_t *start) {
         case DNS_TYPE_TXT: {
                 char *s;
 
+                /* RFC 1035 says that TXT must be at least one
+                   string. Reject empty records. */
+                if (!rdlength) {
+                        r = -EBADMSG;
+                        goto fail;
+                }
+
                 while (p->rindex < offset + rdlength) {
                         r = dns_packet_read_string(p, &s, NULL);
                         if (r < 0)