Check for overflow in $GENERATE computations
$GENERATE uses 'int' for its computations and some constructions can overflow values that can be represented by an 'int' resulting in undefined behaviour. Detect these conditions and return a range error.
This commit is contained in:
18
bin/tests/system/checkzone/zones/bad-generate-range.db
Normal file
18
bin/tests/system/checkzone/zones/bad-generate-range.db
Normal file
@@ -0,0 +1,18 @@
|
||||
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
;
|
||||
; SPDX-License-Identifier: MPL-2.0
|
||||
;
|
||||
; This Source Code Form is subject to the terms of the Mozilla Public
|
||||
; License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
; file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
;
|
||||
; See the COPYRIGHT file distributed with this work for additional
|
||||
; information regarding copyright ownership.
|
||||
|
||||
$TTL 600
|
||||
@ SOA ns hostmaster 2011012708 3600 1200 604800 1200
|
||||
NS ns
|
||||
ns A 192.0.2.1
|
||||
|
||||
; 2147483647 + 1 overflows what can be represented in an 'int'
|
||||
$GENERATE 1-1 host$ TXT foo${2147483647}
|
||||
@@ -725,6 +725,13 @@ genname(char *name, int it, char *buffer, size_t length) {
|
||||
continue;
|
||||
}
|
||||
}
|
||||
/*
|
||||
* 'it' is >= 0 so we don't need to check for
|
||||
* underflow.
|
||||
*/
|
||||
if ((it > 0 && delta > INT_MAX - it)) {
|
||||
return (ISC_R_RANGE);
|
||||
}
|
||||
if (nibblemode) {
|
||||
n = nibbles(numbuf, sizeof(numbuf), width,
|
||||
mode[0], it + delta);
|
||||
|
||||
Reference in New Issue
Block a user