Apply http://www.isc.org/products/BIND/patches/bind4910.diffOPENBSD_3_0

Fixes bugs listed in http://www.isc.org/products/BIND/bind-security.html

1 files changed, 37 insertions, 22 deletions

diff --git a/src/lib/libc/net/getnetnamadr.c b/src/lib/libc/net/getnetnamadr.c
index d3537be17f..9f76ed6d3e 100644
--- a/src/lib/libc/net/getnetnamadr.c
+++ b/src/lib/libc/net/getnetnamadr.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: getnetnamadr.c,v 1.14.2.2 2002/09/09 18:25:08 miod Exp $      */
+/*      $OpenBSD: getnetnamadr.c,v 1.14.2.3 2002/11/14 23:44:14 millert Exp $   */
 
 /*
  * Copyright (c) 1997, Jason Downs.  All rights reserved.
@@ -77,7 +77,7 @@ static char sccsid[] = "@(#)getnetbyaddr.c	8.1 (Berkeley) 6/4/93";
 static char sccsid_[] = "from getnetnamadr.c    1.4 (Coimbra) 93/06/03";
 static char rcsid[] = "$From: getnetnamadr.c,v 8.7 1996/08/05 08:31:35 vixie Exp $";
 #else
-static char rcsid[] = "$OpenBSD: getnetnamadr.c,v 1.14.2.2 2002/09/09 18:25:08 miod Exp $";
+static char rcsid[] = "$OpenBSD: getnetnamadr.c,v 1.14.2.3 2002/11/14 23:44:14 millert Exp $";
 #endif
 #endif /* LIBC_SCCS and not lint */
 
@@ -133,7 +133,7 @@ getnetanswer(answer, anslen, net_i)
         int type, class, ancount, qdcount, haveanswer, i, nchar;
         char aux1[MAXHOSTNAMELEN], aux2[MAXHOSTNAMELEN], ans[MAXHOSTNAMELEN];
         char *in, *st, *pauxt, *bp, **ap, *ep;
-        char *paux1 = &aux1[0], *paux2 = &aux2[0], flag = 0;
+        char *paux1 = &aux1[0], *paux2 = &aux2[0];
         static  struct netent net_entry;
         static  char *net_aliases[MAXALIASES], netbuf[BUFSIZ+1];
 
@@ -165,8 +165,14 @@ getnetanswer(answer, anslen, net_i)
                         h_errno = TRY_AGAIN;
                 return (NULL);
         }
-        while (qdcount-- > 0)
-                cp += __dn_skipname(cp, eom) + QFIXEDSZ;
+        while (qdcount-- > 0) {
+                n = __dn_skipname(cp, eom);
+                if (n < 0 || (cp + n + QFIXEDSZ) > eom) {
+                        h_errno = NO_RECOVERY;
+                        return(NULL);
+                }
+                cp += n + QFIXEDSZ;
+        }
         ap = net_aliases;
         *ap = NULL;
         net_entry.n_aliases = net_aliases;
@@ -198,11 +204,13 @@ getnetanswer(answer, anslen, net_i)
                                 return (NULL);
                         }
                         cp += n; 
-                        *ap++ = bp;
-                        bp += strlen(bp) + 1;
-                        net_entry.n_addrtype =
-                                (class == C_IN) ? AF_INET : AF_UNSPEC;
-                        haveanswer++;
+                        if ((ap + 2) < &net_aliases[MAXALIASES]) {
+                                *ap++ = bp;
+                                bp += strlen(bp) + 1;
+                                net_entry.n_addrtype =
+                                        (class == C_IN) ? AF_INET : AF_UNSPEC;
+                                haveanswer++;
+                        }
                 }
         }
         if (haveanswer) {
@@ -213,25 +221,32 @@ getnetanswer(answer, anslen, net_i)
                         net_entry.n_net = 0L;
                         break;
                 case BYNAME:
-                        in = *net_entry.n_aliases;
-                        net_entry.n_name = &ans[0];
+                        ap = net_entry.n_aliases;
+                next_alias:
+                        in = *ap++;
+                        if (in == NULL) {
+                                h_errno = HOST_NOT_FOUND;
+                                return (NULL);
+                        }
+                        net_entry.n_name = ans;
                         aux2[0] = '\0';
                         for (i = 0; i < 4; i++) {
                                 for (st = in, nchar = 0;
-                                     *st != '.';
+                                     isdigit((unsigned char)*st);
                                      st++, nchar++)
                                         ;
-                                if (nchar != 1 || *in != '0' || flag) {
-                                        flag = 1;
-                                        strlcpy(paux1, 
-                                                (i==0) ? in : in-1, 
-                                                (i==0) ? nchar+1 : nchar+2);
-                                        pauxt = paux2;
-                                        paux2 = strcat(paux1, paux2);
-                                        paux1 = pauxt;
-                                }
+                                if (*st != '.' || nchar == 0 || nchar > 3)
+                                        goto next_alias;
+                                if (i != 0)
+                                        nchar++;
+                                strlcpy(paux1, in, nchar+1);
+                                pauxt = paux2;
+                                paux2 = strcat(paux1, paux2);
+                                paux1 = pauxt;
                                 in = ++st;
                         }                 
+                        if (strcasecmp(in, "IN-ADDR.ARPA") != 0)
+                                goto next_alias;
                         net_entry.n_net = inet_network(paux2);
                         break;
                 }