fix potential buffer overflow when txt records are forged

[project/mdnsd.git] / ubus.c

diff --git a/ubus.c b/ubus.c
index 6d0cdea..c5c8e04 100644 (file)
--- a/ubus.c
+++ b/ubus.c
@@ -17,12 +17,14 @@
 #include <stdio.h>
 
 #include <libubus.h>
-#include <libubox/avl.h>
+#include <libubox/vlist.h>
 #include <libubox/uloop.h>
 
+#include "util.h"
 #include "ubus.h"
 #include "cache.h"
 #include "service.h"
+#include "interface.h"
 
 static struct ubus_auto_conn conn;
 static struct blob_buf b;
@@ -51,15 +53,15 @@ mdns_browse(struct ubus_context *ctx, struct ubus_object *obj,
                struct blob_attr *msg)
 {
        struct cache_entry *s, *q;
-       char buffer[MAX_NAME_LEN];
+       char *buffer = (char *) mdns_buf;
        void *c1 = NULL, *c2;
 
-        blob_buf_init(&b, 0);
+       blob_buf_init(&b, 0);
        avl_for_each_element(&entries, s, avl) {
                char *local;
                if (*((char *) s->avl.key) != '_')
                        continue;
-               snprintf(buffer, MAX_NAME_LEN, s->avl.key);
+               snprintf(buffer, MAX_NAME_LEN, "%s", (const char *) s->avl.key);
                local = strstr(buffer, ".local");
                if (local)
                        *local = '\0';
@@ -69,7 +71,7 @@ mdns_browse(struct ubus_context *ctx, struct ubus_object *obj,
                if (!c1) {
                        c1 = blobmsg_open_table(&b, buffer);
                }
-               snprintf(buffer, MAX_NAME_LEN, s->entry);
+               snprintf(buffer, MAX_NAME_LEN, "%s", (const char *) s->entry);
                local = strstr(buffer, "._");
                if (local)
                        *local = '\0';
@@ -95,15 +97,15 @@ mdns_hosts(struct ubus_context *ctx, struct ubus_object *obj,
                struct blob_attr *msg)
 {
        struct cache_entry *s;
-       char buffer[MAX_NAME_LEN];
+       char *buffer = (char *) mdns_buf;
        void *c;
 
-        blob_buf_init(&b, 0);
+       blob_buf_init(&b, 0);
        avl_for_each_element(&entries, s, avl) {
                char *local;
                if (*((char *) s->avl.key) == '_')
                        continue;
-               snprintf(buffer, MAX_NAME_LEN, s->entry);
+               snprintf(buffer, MAX_NAME_LEN, "%s", (const char *) s->entry);
                local = strstr(buffer, "._");
                if (local)
                        *local = '\0';
@@ -118,7 +120,36 @@ mdns_hosts(struct ubus_context *ctx, struct ubus_object *obj,
        return UBUS_STATUS_OK;
 }
 
+static const struct blobmsg_policy config_policy[] = {
+       { "interfaces", BLOBMSG_TYPE_ARRAY },
+};
+
+static int
+mdns_set_config(struct ubus_context *ctx, struct ubus_object *obj,
+                   struct ubus_request_data *req, const char *method,
+                   struct blob_attr *msg)
+{
+       struct blob_attr *data, *cur;
+       int rem;
+
+       blobmsg_parse(config_policy, 1, &data, blob_data(msg), blob_len(msg));
+       if (!data)
+               return UBUS_STATUS_INVALID_ARGUMENT;
+
+       if (!blobmsg_check_attr_list(data, BLOBMSG_TYPE_STRING))
+               return UBUS_STATUS_INVALID_ARGUMENT;
+
+       vlist_update(&interfaces);
+       blobmsg_for_each_attr(cur, data, rem)
+               interface_add(blobmsg_data(cur));
+       vlist_flush(&interfaces);
+
+       return 0;
+}
+
+
 static const struct ubus_method mdns_methods[] = {
+       UBUS_METHOD("set_config", mdns_set_config, config_policy),
        UBUS_METHOD_NOARG("scan", mdns_scan),
        UBUS_METHOD_NOARG("browse", mdns_browse),
        UBUS_METHOD_NOARG("hosts", mdns_hosts),