df/zeroconf
1
0
Fork 0
Code Issues 7 Pull Requests 1 Releases Wiki Activity

Added checks for NULL after uncompressing labels.

Browse Source
This commit is contained in:
Darell Tan 2018-01-16 22:55:15 +08:00
parent 9f70ccd676
commit a155bbd914
1 changed files with 28 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
mdns.c
View File

@ -55,6 +55,9 @@ struct name_comp {
// duplicates a name // duplicates a name
inline uint8_t *dup_nlabel(const uint8_t *n) { inline uint8_t *dup_nlabel(const uint8_t *n) {
if (n == NULL)
return NULL;
assert(n[0] <= 63); // prevent mis-use assert(n[0] <= 63); // prevent mis-use
return (uint8_t *) strdup((char *) n); return (uint8_t *) strdup((char *) n);
} }
@ -92,7 +95,8 @@ char *nlabel_to_str(const uint8_t *name) {
const uint8_t *p; const uint8_t *p;
size_t buf_len = 256; size_t buf_len = 256;
assert(name != NULL); if (name == NULL)
return NULL;
label = labelp = malloc(buf_len); label = labelp = malloc(buf_len);
@ -149,7 +153,9 @@ uint8_t *create_label(const char *txt) {
int len; int len;
uint8_t *s; uint8_t *s;
assert(txt != NULL); if (txt == NULL)
return NULL;
len = strlen(txt); len = strlen(txt);
if (len > 63) if (len > 63)
return NULL; return NULL;
@ -598,9 +604,15 @@ static size_t mdns_parse_qn(uint8_t *pkt_buf, size_t pkt_len, size_t off,
assert(pkt != NULL); assert(pkt != NULL);
rr = malloc(sizeof(struct rr_entry)); rr = malloc(sizeof(struct rr_entry));
if (rr == NULL)
goto err;
memset(rr, 0, sizeof(struct rr_entry)); memset(rr, 0, sizeof(struct rr_entry));
name = uncompress_nlabel(pkt_buf, pkt_len, off); name = uncompress_nlabel(pkt_buf, pkt_len, off);
if (name == NULL)
goto err;
p += label_len(pkt_buf, pkt_len, off); p += label_len(pkt_buf, pkt_len, off);
rr->name = name; rr->name = name;
@ -614,6 +626,10 @@ static size_t mdns_parse_qn(uint8_t *pkt_buf, size_t pkt_len, size_t off,
rr_list_append(&pkt->rr_qn, rr); rr_list_append(&pkt->rr_qn, rr);
return p - (pkt_buf + off); return p - (pkt_buf + off);
err:
free(rr);
return 0;
} }
// parse the MDNS RR section // parse the MDNS RR section
@ -634,9 +650,15 @@ static size_t mdns_parse_rr(uint8_t *pkt_buf, size_t pkt_len, size_t off,
return 0; return 0;
rr = malloc(sizeof(struct rr_entry)); rr = malloc(sizeof(struct rr_entry));
if (rr == NULL)
goto err;
memset(rr, 0, sizeof(struct rr_entry)); memset(rr, 0, sizeof(struct rr_entry));
name = uncompress_nlabel(pkt_buf, pkt_len, off); name = uncompress_nlabel(pkt_buf, pkt_len, off);
if (name == NULL)
goto err;
p += label_len(pkt_buf, pkt_len, off); p += label_len(pkt_buf, pkt_len, off);
rr->name = name; rr->name = name;
@ -739,6 +761,10 @@ static size_t mdns_parse_rr(uint8_t *pkt_buf, size_t pkt_len, size_t off,
rr_list_append(&pkt->rr_ans, rr); rr_list_append(&pkt->rr_ans, rr);
return p - (pkt_buf + off); return p - (pkt_buf + off);
err:
free(rr);
return 0;
} }
// parse a MDNS packet into an mdns_pkt struct // parse a MDNS packet into an mdns_pkt struct