security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-01-05 12:31:50 +01:00
Code Activity

dirmngr: Do not use MAXDNAME.

Browse Source 
* dirmngr/dns-stuff.c (getsrv): Replace MAXDNAME.
* dirmngr/dns-stuff.h (MAXDNAME): Remove.
(struct srventry): Use a fixed value instead of MAXDNAME.
* dirmngr/http.c (connect_server): Use DIMof instead of MAXDNAME.
Malloc a helper array.

--

Depending on the order of included headers it might be that we allocate
the array with a different size than what we test against in another
module.  To make it more robust we use the actual known size of
checking.

A better would be to use a linked list and avoid these large arrays.

Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2015-10-22 09:52:51 +02:00
parent 41bb01ae79
commit e03a4a94bb
No known key found for this signature in database
GPG Key ID: E3FDFF218E45B72B
3 changed files with 20 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
dirmngr/dns-stuff.c
View File

@ -651,7 +651,7 @@ getsrv (const char *name,struct srventry **list)
struct srventry *srv = NULL; struct srventry *srv = NULL;
struct srventry *newlist; struct srventry *newlist;
if (strlen (answer->rrs.srvha[count].ha.host) >= MAXDNAME) if (strlen (answer->rrs.srvha[count].ha.host) >= sizeof srv->target)
{ {
log_info ("hostname in SRV record too long - skipped\n"); log_info ("hostname in SRV record too long - skipped\n");
continue; continue;
@ -747,7 +747,7 @@ getsrv (const char *name,struct srventry **list)
/* Get the name. 2782 doesn't allow name compression, but /* Get the name. 2782 doesn't allow name compression, but
dn_expand still works to pull the name out of the dn_expand still works to pull the name out of the
packet. */ packet. */
rc = dn_expand(answer,emsg,pt,srv->target,MAXDNAME); rc = dn_expand(answer,emsg,pt,srv->target, sizeof srv->target);
if (rc == 1 && srv->target[0] == 0) /* "." */ if (rc == 1 && srv->target[0] == 0) /* "." */
{ {
xfree(*list); xfree(*list);

7
dirmngr/dns-stuff.h
View File

@ -71,18 +71,13 @@ struct dns_addrinfo_s
}; };
#ifndef MAXDNAME
#define MAXDNAME 1025
#endif
struct srventry struct srventry
{ {
unsigned short priority; unsigned short priority;
unsigned short weight; unsigned short weight;
unsigned short port; unsigned short port;
int run_count; int run_count;
char target[MAXDNAME]; char target[1025];
}; };

18
dirmngr/http.c
View File

@ -2251,13 +2251,23 @@ connect_server (const char *server, unsigned short port,
if (srvtag) if (srvtag)
{ {
/* We're using SRV, so append the tags. */ /* We're using SRV, so append the tags. */
if (1+strlen (srvtag) + 6 + strlen (server) + 1 <= MAXDNAME) if (1 + strlen (srvtag) + 6 + strlen (server) + 1
<= DIMof (struct srventry, target))
{ {
char srvname[MAXDNAME]; char *srvname = xtrymalloc (DIMof (struct srventry, target));
if (!srvname) /* Out of core */
{
serverlist = NULL;
srvcount = 0;
}
else
{
stpcpy (stpcpy (stpcpy (stpcpy (srvname,"_"), srvtag), stpcpy (stpcpy (stpcpy (stpcpy (srvname,"_"), srvtag),
"._tcp."), server); "._tcp."), server);
srvcount = getsrv (srvname, &serverlist); srvcount = getsrv (srvname, &serverlist);
xfree (srvname);
}
} }
} }
#else #else
@ -2273,8 +2283,8 @@ connect_server (const char *server, unsigned short port,
if (!serverlist) if (!serverlist)
return -1; /* Out of core. */ return -1; /* Out of core. */
serverlist->port = port; serverlist->port = port;
strncpy (serverlist->target, server, MAXDNAME); strncpy (serverlist->target, server, DIMof (struct srventry, target));
serverlist->target[MAXDNAME-1] = '\0'; serverlist->target[DIMof (struct srventry, target)-1] = '\0';
srvcount = 1; srvcount = 1;
} }