upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-27 11:10:22 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch '3175-add-missing-grow-data-call-in-isc-lex-gettoken-v9_16' into 'v9_16'

Browse source 
Grow the lex token buffer in one more place

See merge request isc-projects/bind9!5919
This commit is contained in:
Mark Andrews 2022-03-02 02:13:30 +00:00
commit 4ac616bb4a
3 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,3 +1,7 @@
5815. [bug] If an oversized key name of a specific length was used
in the text form of an HTTP or SVBC record, an INSIST
could be triggered when parsing it. [GL #3175]
5814. [bug] The RecursClients statistics counter could underflow
in certain resolution scenarios. [GL #3147]

1
fuzz/dns_rdata_fromtext.in/svbc-max-token Normal file
View file

@ -0,0 +1 @@
1 65 8 . aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa=

8
lib/isc/lex.c
View file

@ -670,6 +670,13 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
case lexstate_string:
if (!escaped && c == '=' &&
(options & ISC_LEXOPT_VPAIR) != 0) {
if (remaining == 0U) {
result = grow_data(lex, &remaining,
&curr, &prev);
if (result != ISC_R_SUCCESS) {
goto done;
}
}
INSIST(remaining > 0U);
*curr++ = c;
*curr = '\0';
@ -682,7 +689,6 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
if (state == lexstate_vpairstart) {
if (c == '"' &&
(options & ISC_LEXOPT_QVPAIR) != 0) {
INSIST(remaining > 0U);
no_comments = true;
state = lexstate_qvpair;
break;