projects
/
project
/
mdnsd.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
fix potential null pointer deref when packets are forged
[project/mdnsd.git]
/
cache.c
diff --git
a/cache.c
b/cache.c
index
150fb26
..
812478e
100644
(file)
--- a/
cache.c
+++ b/
cache.c
@@
-126,14
+126,14
@@
cache_scan(void)
static struct cache_entry*
cache_entry(struct interface *iface, char *entry, int hlen, int ttl)
{
static struct cache_entry*
cache_entry(struct interface *iface, char *entry, int hlen, int ttl)
{
- struct cache_entry *s;
+ struct cache_entry *s
, *t
;
char *entry_buf;
char *host_buf;
char *type;
char *entry_buf;
char *host_buf;
char *type;
- s = avl_find_element(&entries, entry, s, avl);
-
if (s
)
- return s;
+ avl_for_each_element_safe(&entries, s, avl, t)
+
if (!strcmp(s->entry, entry)
)
+
return s;
s = calloc_a(sizeof(*s),
&entry_buf, strlen(entry) + 1,
s = calloc_a(sizeof(*s),
&entry_buf, strlen(entry) + 1,
@@
-167,7
+167,7
@@
cache_record_find(char *record, int type, int port, int rdlength, uint8_t *rdata
if (!l)
return NULL;
if (!l)
return NULL;
- while (l &&
!avl_is_last(&records, &l->avl)
&& !strcmp(l->record, record)) {
+ while (l &&
l->record
&& !strcmp(l->record, record)) {
struct cache_record *r = l;
l = avl_next_element(l, avl);
struct cache_record *r = l;
l = avl_next_element(l, avl);
@@
-274,7
+274,7
@@
cache_answer(struct interface *iface, uint8_t *base, int blen, char *name, struc
uint8_t v = *p;
*p = '\0';
uint8_t v = *p;
*p = '\0';
- if (v)
+ if (v
&& p + v < &rdata_buffer[rdlength]
)
p += v + 1;
} while (*p);
break;
p += v + 1;
} while (*p);
break;