Changeset 481 for trunk/src/sh_static.c

Timestamp:

Jul 18, 2015, 5:06:52 PM (10 years ago)

Author:

katerina

Message:

Enhancements and fixes for tickets #374, #375, #376, #377, #378, and #379.

File:

• trunk/src/sh_static.c (modified) (9 diffs)

trunk/src/sh_static.c

@@ -999 +999 @@
                 return -1;
 
-        while ((l = data[offset++])) {
+        while ((l = data[offset])) {
+
+                if (offset < INT_MAX)
+                        offset++;
+                else
+                        return -1;
 
                 if ((l & 0xc0) == (0xc0)) {
-                        offset++;
+                        if (offset < INT_MAX)
+                          offset++;
+                        else
+                          return -1;
                         break;
                 }
 
-                offset += l;
+                if (offset <= (INT_MAX - l))
+                  offset += l;
+                else
+                  return -1;
         }
 
@@ -1019 +1030 @@
         if (i < 0)
                 return i;
-
-        return i + 4;
+        if (i < (INT_MAX - 4))
+          return i + 4;
+        else
+          return -1;
 }
 
@@ -1036 +1049 @@
         if (!data)
                 return -1;
-
-        while ((l=data[offset++])) {
-                if (measure)
+        while ((l=data[offset])) {
+                if (offset < INT_MAX) offset++;
+                else return -1;
+                if (measure && (total < INT_MAX))
                     total++;
                 if ((l & 0xc0) == (0xc0)) {
-                        if (measure)
+                        if (measure && (total < INT_MAX))
                                 total++;
-                        /* compressed item, redirect */
+                        /* compressed item, redirect */ 
                         offset = ((l & 0x3f) << 8) | data[offset];
+                        if (offset < 0)
+                          return -1; 
                         measure = 0;
                         continue;
                 }
+                
+                if (used >= (INT_MAX - l))
+                  return -1;
 
                 if ((used + l + 1) >= maxlen)
-                        return -1;
+                  return -1; 
 
                 memcpy(dest + used, data + offset, l);
-                offset += l;
-                used += l;
-                if (measure)
+                
+                if (offset <= (INT_MAX - l))
+                  offset += l;
+                else
+                  return -1;
+
+                if (used <= (INT_MAX - l))
+                  used += l;
+                else
+                  return -1;
+                if (measure && (total <= (INT_MAX - l)))
                         total += l;
 
+                if (used == INT_MAX)
+                  return -1;
                 if (data[offset] != 0)
                         dest[used++] = '.';
@@ -1065 +1094 @@
 
         /* The null byte must be counted too */
-        if (measure) {
+        if (measure && (total < INT_MAX)) {
             total++;
         }
@@ -1078 +1107 @@
 {
         char temp[256];
-        int i;
+        int i = 0;
 
         i = __decode_dotted(message, offset, temp, sizeof(temp));
@@ -1084 +1113 @@
                 return i;
 
-        message += offset + i;
+        if (offset <= (INT_MAX - i))
+          message += offset + i;
+        else
+          return -1;
 
         a->dotted = strdup(temp);
@@ -1101 +1133 @@
         DPRINTF("i=%d,rdlength=%d\n", i, a->rdlength);
 
-        return i + RRFIXEDSZ + a->rdlength;
+        if (RRFIXEDSZ <= (INT_MAX - i))
+          i += RRFIXEDSZ;
+        else
+          return -1;
+        if (a->rdlength <= (INT_MAX - i))
+          return i + a->rdlength;
+        else
+          return -1;
 }
 
@@ -1148 +1187 @@
 
         dest += i;
+        if (maxlen < i)
+          return -1;
         maxlen -= i;
 
@@ -1158 +1199 @@
         dest[3] = (q->qclass & 0x00ff) >> 0;
 
-        return i + 4;
+        if (i <= (INT_MAX - 4))
+          return i + 4;
+        else
+          return -1;
 }