From owner-freebsd-bugs  Wed Apr 26  9: 0: 8 2000
Delivered-To: freebsd-bugs@freebsd.org
Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21])
	by hub.freebsd.org (Postfix) with ESMTP id CD2B037B78A
	for <freebsd-bugs@FreeBSD.org>; Wed, 26 Apr 2000 09:00:05 -0700 (PDT)
	(envelope-from gnats@FreeBSD.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.9.3/8.9.2) id JAA46940;
	Wed, 26 Apr 2000 09:00:05 -0700 (PDT)
	(envelope-from gnats@FreeBSD.org)
Date: Wed, 26 Apr 2000 09:00:05 -0700 (PDT)
Message-Id: <200004261600.JAA46940@freefall.freebsd.org>
To: freebsd-bugs@FreeBSD.org
Cc: 
From: Bill Fenner <fenner@research.att.com>
Subject: Re: bin/18221: DNS resolver can fail for large DNS responses
Reply-To: Bill Fenner <fenner@research.att.com>
Sender: owner-freebsd-bugs@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

The following reply was made to PR bin/18221; it has been noted by GNATS.

From: Bill Fenner <fenner@research.att.com>
To: john@nlc.net.au
Cc: freebsd-gnats-submit@freebsd.org
Subject: Re: bin/18221: DNS resolver can fail for large DNS responses
Date: Wed, 26 Apr 2000 08:08:32 -0700

 I didn't return the truncated response because I was worried about
 whether all the relevant functions handled truncated responses.
 Have you checked this?
 
 >@@ -666,7 +669,6 @@
 > 	}
 > 	if (n > sizeof buf.buf) {
 > 		dprintf("static buffer is too small (%d)\n", n);
 >-		return (NULL);
 > 	}
 > 	if (!(hp = gethostanswer(&buf, n, qbuf, T_PTR)))
 > 		return (NULL);	/* h_errno was set by gethostanswer() */
 
 Didn't you just reintroduce the buffer overrun?  (e.g. you at least want
 to truncate n to sizeof buf.buf)
 
   Bill
 


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message