diff options
| author | cinap_lenrek <cinap_lenrek@gmx.de> | 2012-03-23 04:02:34 +0100 |
|---|---|---|
| committer | cinap_lenrek <cinap_lenrek@gmx.de> | 2012-03-23 04:02:34 +0100 |
| commit | 9840c9f18e2b6a15f89ecb3cf6420d2329685c00 (patch) | |
| tree | 7e05003deb7caabd3b67861330441323de953c66 /sys/src/libndb | |
| parent | d3e7560e04adc329c3ec2edb578cabb956ed44e5 (diff) | |
ndb/cs: fix use after free caused by flush/clunk happening before dns lookup finishes
Diffstat (limited to 'sys/src/libndb')
| -rw-r--r-- | sys/src/libndb/dnsquery.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/sys/src/libndb/dnsquery.c b/sys/src/libndb/dnsquery.c index 15230312c..b3c982fdf 100644 --- a/sys/src/libndb/dnsquery.c +++ b/sys/src/libndb/dnsquery.c @@ -81,12 +81,17 @@ mkptrname(char *ip, char *rip, int rlen) char *p, *np; int len; - if(strstr(ip, "in-addr.arpa") || strstr(ip, "IN-ADDR.ARPA")){ + if(cistrstr(ip, "in-addr.arpa")){ nstrcpy(rip, ip, rlen); return; } - nstrcpy(buf, ip, sizeof buf); + + /* truncate if result wont fit in rip[rlen] */ + assert(rlen > 14); + if((rlen-14) < sizeof(buf)) + buf[rlen-14] = 0; + for(p = buf; *p; p++) ; *p = '.'; |