Commit 98998f3d authored by Mukund Sivaraman's avatar Mukund Sivaraman
Browse files

Fix out of bounds access in DHCID totext() method (#46001)

parent d5707676
4780. [bug] Fix out of bounds access in DHCID totext() method.
[RT #46001]
4729. [bug] Don't use memset() to wipe memory, as it may be
removed by compiler optimizations when the
memset() occurs on automatic stack allocation
......
......@@ -32,7 +32,7 @@ fromtext_in_dhcid(ARGS_FROMTEXT) {
static inline isc_result_t
totext_in_dhcid(ARGS_TOTEXT) {
isc_region_t sr;
isc_region_t sr, sr2;
char buf[sizeof(" ; 64000 255 64000")];
size_t n;
......@@ -41,6 +41,7 @@ totext_in_dhcid(ARGS_TOTEXT) {
REQUIRE(rdata->length != 0);
dns_rdata_toregion(rdata, &sr);
sr2 = sr;
if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
RETERR(str_totext("( " /*)*/, target));
......@@ -53,8 +54,8 @@ totext_in_dhcid(ARGS_TOTEXT) {
RETERR(str_totext(/* ( */ " )", target));
if (rdata->length > 2) {
n = snprintf(buf, sizeof(buf), " ; %u %u %u",
sr.base[0] * 256 + sr.base[1],
sr.base[2], rdata->length - 3);
sr2.base[0] * 256 + sr2.base[1],
sr2.base[2], rdata->length - 3);
INSIST(n < sizeof(buf));
RETERR(str_totext(buf, target));
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment