Date: Wed, 23 Feb 2000 22:24:59 -0800 (PST) From: spock@techfour.net To: freebsd-gnats-submit@FreeBSD.org Subject: bin/16953: [PATCH] Fix argument overflow in dnsquery Message-ID: <200002240624.WAA68360@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 16953 >Category: bin >Synopsis: [PATCH] Fix argument overflow in dnsquery >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Feb 23 22:30:01 PST 2000 >Closed-Date: >Last-Modified: >Originator: Mike Heffner >Release: 4.0-current >Organization: >Environment: FreeBSD 4.0-CURRENT #0: Sat Feb 19 20:05:45 EST 2000 >Description: dnsquery doesn't check domain name length and will write past buffer. >How-To-Repeat: dnsquery -h [5120] or dnsquery [5120] >Fix: Apply patch. Merged from OpenBSD. Index: contrib/bind/bin/dnsquery/dnsquery.c =================================================================== RCS file: /home/ncvs/src/contrib/bind/bin/dnsquery/dnsquery.c,v retrieving revision 1.1.1.2 diff -u -r1.1.1.2 dnsquery.c --- dnsquery.c 1999/11/30 02:42:02 1.1.1.2 +++ dnsquery.c 2000/02/24 06:09:09 @@ -80,7 +80,11 @@ case 'p' : res.retrans = atoi(optarg); break; - case 'h' : strcpy(name, optarg); + case 'h' : if(strlcpy(name, optarg, sizeof(name)) >= sizeof(name)) { + fprintf(stderr, + "Domain name too long (%s)\n", optarg); + exit(-1); + } break; case 'c' : { @@ -157,9 +161,14 @@ exit(-1); } } - if (optind < argc) - strcpy(name, argv[optind]); - + if (optind < argc) { + if (strlcpy(name, argv[optind], sizeof(name)) >= sizeof(name)){ + fprintf(stderr, + "Domain name too long (%s)\n", argv[optind]); + exit(-1); + } + } + len = sizeof(answer); if (!(res.options & RES_INIT)) >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200002240624.WAA68360>