dns.c: improve input validation

[project/mdnsd.git] / dns.c

diff --git a/dns.c b/dns.c
index 899b1245f61c4e8d1877d614d5b1921454c44389..c64f3b1be3d3e73fa4453a0158d850b958ce110e 100644 (file)
--- a/dns.c
+++ b/dns.c
@@ -68,7 +68,8 @@ dns_type_string(uint16_t type)
 }
 
 void
-dns_send_question(struct interface *iface, const char *question, int type, int multicast)
+dns_send_question(struct interface *iface, struct sockaddr *to,
+                 const char *question, int type, int multicast)
 {
        static struct dns_header h;
        static struct dns_question q;
@@ -98,7 +99,7 @@ dns_send_question(struct interface *iface, const char *question, int type, int m
        iov[1].iov_len = len;
 
        DBG(1, "Q <- %s %s\n", dns_type_string(type), question);
-       if (interface_send_packet(iface, NULL, iov, ARRAY_SIZE(iov)) < 0)
+       if (interface_send_packet(iface, to, iov, ARRAY_SIZE(iov)) < 0)
                perror("failed to send question");
 }
 
@@ -221,6 +222,7 @@ scan_name(const uint8_t *buffer, int len)
                if (IS_COMPRESSED(l))
                        return offset + 2;
 
+               if (l + 1 > len) return -1;
                len -= l + 1;
                offset += l + 1;
                buffer += l + 1;
@@ -236,16 +238,16 @@ static struct dns_header*
 dns_consume_header(uint8_t **data, int *len)
 {
        struct dns_header *h = (struct dns_header *) *data;
-       uint16_t *swap = (uint16_t *) h;
-       int endianess = 6;
 
        if (*len < sizeof(struct dns_header))
                return NULL;
 
-       while (endianess--) {
-               *swap = be16_to_cpu(*swap);
-               swap++;
-       }
+       h->id = be16_to_cpu(h->id);
+       h->flags = be16_to_cpu(h->flags);
+       h->questions = be16_to_cpu(h->questions);
+       h->answers = be16_to_cpu(h->answers);
+       h->authority = be16_to_cpu(h->authority);
+       h->additional = be16_to_cpu(h->additional);
 
        *len -= sizeof(struct dns_header);
        *data += sizeof(struct dns_header);
@@ -257,16 +259,12 @@ static struct dns_question*
 dns_consume_question(uint8_t **data, int *len)
 {
        struct dns_question *q = (struct dns_question *) *data;
-       uint16_t *swap = (uint16_t *) q;
-       int endianess = 2;
 
        if (*len < sizeof(struct dns_question))
                return NULL;
 
-       while (endianess--) {
-               *swap = be16_to_cpu(*swap);
-               swap++;
-       }
+       q->type = be16_to_cpu(q->type);
+       q->class = be16_to_cpu(q->class);
 
        *len -= sizeof(struct dns_question);
        *data += sizeof(struct dns_question);
@@ -320,7 +318,7 @@ static int parse_answer(struct interface *iface, struct sockaddr *from,
        struct dns_answer *a;
        uint8_t *rdata;
 
-       if (!name) {
+       if (!name || rlen < 0) {
                fprintf(stderr, "dropping: bad question\n");
                return -1;
        }
@@ -368,7 +366,7 @@ parse_question(struct interface *iface, struct sockaddr *from, char *name, struc
        case TYPE_ANY:
                if (!strcmp(name, mdns_hostname_local)) {
                        dns_reply_a(iface, to, announce_ttl);
-                       service_reply(iface, to, NULL, announce_ttl);
+                       service_reply(iface, to, NULL, NULL, announce_ttl);
                }
                break;
 
@@ -377,15 +375,18 @@ parse_question(struct interface *iface, struct sockaddr *from, char *name, struc
                        dns_reply_a(iface, to, announce_ttl);
                        service_announce_services(iface, to, announce_ttl);
                } else {
-                       /* First dot separates instance name from the rest */
-                       char *dot = strchr(name, '.');
-                       /* Length of queried instance */
-                       size_t len = dot ? dot - name : 0;
-
-                       /* Make sure it's query for the instance name we use */
-                       if (len && len == strlen(mdns_hostname) &&
-                           !strncmp(name, mdns_hostname, len))
-                               service_reply(iface, to, dot + 1, announce_ttl);
+                       if (name[0] == '_') {
+                               service_reply(iface, to, NULL, name, announce_ttl);
+                       } else {
+                               /* First dot separates instance name from the rest */
+                               char *dot = strchr(name, '.');
+
+                               if (dot) {
+                                       *dot = '\0';
+                                       service_reply(iface, to, name, dot + 1, announce_ttl);
+                                       *dot = '.';
+                               }
+                       }
                }
                break;
 
@@ -394,7 +395,7 @@ parse_question(struct interface *iface, struct sockaddr *from, char *name, struc
                host = strstr(name, ".local");
                if (host)
                        *host = '\0';
-               if (!strcmp(mdns_hostname, name))
+               if (!strcmp(umdns_host_label, name))
                        dns_reply_a(iface, to, announce_ttl);
                break;
        };
@@ -421,7 +422,7 @@ dns_handle_packet(struct interface *iface, struct sockaddr *from, uint16_t port,
                char *name = dns_consume_name(buffer, len, &b, &rlen);
                struct dns_question *q;
 
-               if (!name) {
+               if (!name || rlen < 0) {
                        fprintf(stderr, "dropping: bad name\n");
                        return;
                }