fix potential null pointer deref when packets are forged

[project/mdnsd.git] / cache.c

diff --git a/cache.c b/cache.c
index adfc815..812478e 100644 (file)
--- a/cache.c
+++ b/cache.c
@@ -126,14 +126,14 @@ cache_scan(void)
 static struct cache_entry*
 cache_entry(struct interface *iface, char *entry, int hlen, int ttl)
 {
-       struct cache_entry *s;
+       struct cache_entry *s, *t;
        char *entry_buf;
        char *host_buf;
        char *type;
 
-       s = avl_find_element(&entries, entry, s, avl);
-       if (s)
-               return s;
+       avl_for_each_element_safe(&entries, s, avl, t)
+               if (!strcmp(s->entry, entry))
+                       return s;
 
        s = calloc_a(sizeof(*s),
                &entry_buf, strlen(entry) + 1,
@@ -167,7 +167,7 @@ cache_record_find(char *record, int type, int port, int rdlength, uint8_t *rdata
        if (!l)
                return NULL;
 
-       while (l && !avl_is_last(&records, &l->avl) && !strcmp(l->record, record)) {
+       while (l && l->record && !strcmp(l->record, record)) {
                struct cache_record *r = l;
 
                l = avl_next_element(l, avl);
@@ -274,7 +274,7 @@ cache_answer(struct interface *iface, uint8_t *base, int blen, char *name, struc
                        uint8_t v = *p;
 
                        *p = '\0';
-                       if (v)
+                       if (v && p + v < &rdata_buffer[rdlength])
                                p += v + 1;
                } while (*p);
                break;
@@ -300,8 +300,8 @@ cache_answer(struct interface *iface, uint8_t *base, int blen, char *name, struc
        r = cache_record_find(name, a->type, port, dlen, rdata);
        if (r) {
                if (!a->ttl) {
-                       cache_record_free(r);
                        DBG(1, "D -> %s %s ttl:%d\n", dns_type_string(r->type), r->record, r->ttl);
+                       cache_record_free(r);
                } else {
                        r->ttl = a->ttl;
                        DBG(1, "A -> %s %s ttl:%d\n", dns_type_string(r->type), r->record, r->ttl);