Fix possible buffer overflows in DNS handling

[odhcp6c.git] / src / script.c

diff --git a/src/script.c b/src/script.c
index a56d9b4df42c62947ec9d9c5d6b1f05668aa70da..b9bf0aa094ade19926eaadee5e6f31eaee089f01 100644 (file)
--- a/src/script.c
+++ b/src/script.c
@@ -98,13 +98,14 @@ static void ipv6_to_env(const char *name,
 static void fqdn_to_env(const char *name, const uint8_t *fqdn, size_t len)
 {
        size_t buf_len = strlen(name);
+       size_t buf_size = len + buf_len + 2;
        const uint8_t *fqdn_end = fqdn + len;
        char *buf = realloc(NULL, len + buf_len + 2);
        memcpy(buf, name, buf_len);
        buf[buf_len++] = '=';
        int l = 1;
        while (l > 0 && fqdn < fqdn_end) {
-               l = dn_expand(fqdn, &fqdn[len], fqdn, &buf[buf_len], len);
+               l = dn_expand(fqdn, fqdn_end, fqdn, &buf[buf_len], buf_size - buf_len);
                fqdn += l;
                buf_len += strlen(&buf[buf_len]);
                buf[buf_len++] = ' ';
@@ -164,7 +165,7 @@ static void entry_to_env(const char *name, const void *data, size_t len, enum en
 
                        if (type == ENTRY_PREFIX && e[i].priority) {
                                // priority and router are abused for prefix exclusion
-                               buf[buf_len++] = ',';
+                               buf_len += snprintf(&buf[buf_len], 12, ",excluded=");
                                inet_ntop(AF_INET6, &e[i].router, &buf[buf_len], INET6_ADDRSTRLEN);
                                buf_len += strlen(&buf[buf_len]);
                                buf_len += snprintf(&buf[buf_len], 24, "/%u", e[i].priority);
@@ -198,7 +199,7 @@ void script_delay_call(const char *status, int timeout)
 void script_call(const char *status)
 {
        size_t dns_len, search_len, custom_len, sntp_ip_len, sntp_dns_len;
-       size_t sip_ip_len, sip_fqdn_len;
+       size_t sip_ip_len, sip_fqdn_len, aftr_name_len;
 
        odhcp6c_expire();
        if (delayed_call)
@@ -211,6 +212,7 @@ void script_call(const char *status)
        uint8_t *sntp_dns = odhcp6c_get_state(STATE_SNTP_FQDN, &sntp_dns_len);
        struct in6_addr *sip = odhcp6c_get_state(STATE_SIP_IP, &sip_ip_len);
        uint8_t *sip_fqdn = odhcp6c_get_state(STATE_SIP_FQDN, &sip_fqdn_len);
+       uint8_t *aftr_name = odhcp6c_get_state(STATE_AFTR_NAME, &aftr_name_len);
 
        size_t prefix_len, address_len, ra_pref_len, ra_route_len, ra_dns_len;
        uint8_t *prefix = odhcp6c_get_state(STATE_IA_PD, &prefix_len);
@@ -227,6 +229,7 @@ void script_call(const char *status)
                fqdn_to_env("DOMAINS", search, search_len);
                fqdn_to_env("SNTP_FQDN", sntp_dns, sntp_dns_len);
                fqdn_to_env("SIP_DOMAIN", sip_fqdn, sip_fqdn_len);
+               fqdn_to_env("AFTR", aftr_name, aftr_name_len);
                bin_to_env(custom, custom_len);
                entry_to_env("PREFIXES", prefix, prefix_len, ENTRY_PREFIX);
                entry_to_env("ADDRESSES", address, address_len, ENTRY_ADDRESS);