25 lines
1.2 KiB
Text
25 lines
1.2 KiB
Text
Avoid careless dereferences outside the domain name buffer.
|
|
Part of this is
|
|
https://github.com/nmap/nmap/commit/3adaa69cb211b00f9bfc66263a56cbd87cc9e521
|
|
|
|
Index: nmap_dns.cc
|
|
--- nmap_dns.cc.orig
|
|
+++ nmap_dns.cc
|
|
@@ -1352,7 +1352,7 @@ bool DNS::Factory::ptrToIp(const std::string &ptr, soc
|
|
memset(&ip, 0, sizeof(sockaddr_storage));
|
|
|
|
// Check whether the name ends with the IPv4 PTR domain
|
|
- if (NULL != (p = strcasestr(cptr + ptr.length() + 1 - sizeof(C_IPV4_PTR_DOMAIN), C_IPV4_PTR_DOMAIN)))
|
|
+ if (ptr.length() >= sizeof(C_IPV4_PTR_DOMAIN) - 1 && NULL != (p = strcasestr(cptr + ptr.length() + 1 - sizeof(C_IPV4_PTR_DOMAIN), C_IPV4_PTR_DOMAIN)))
|
|
{
|
|
struct sockaddr_in *ip4 = (struct sockaddr_in *)&ip;
|
|
static const u8 place_value[] = {1, 10, 100};
|
|
@@ -1387,7 +1387,7 @@ bool DNS::Factory::ptrToIp(const std::string &ptr, soc
|
|
ip.ss_family = AF_INET;
|
|
}
|
|
// If not, check IPv6
|
|
- else if (NULL != (p = strcasestr(cptr + ptr.length() + 1 - sizeof(C_IPV6_PTR_DOMAIN), C_IPV6_PTR_DOMAIN)))
|
|
+ else if (ptr.length() >= sizeof(C_IPV6_PTR_DOMAIN) - 1 && NULL != (p = strcasestr(cptr + ptr.length() + 1 - sizeof(C_IPV6_PTR_DOMAIN), C_IPV6_PTR_DOMAIN)))
|
|
{
|
|
struct sockaddr_in6 *ip6 = (struct sockaddr_in6 *)&ip;
|
|
u8 alt = 0;
|