Check for overflow in $GENERATE computations

$GENERATE uses 'int' for its computations and some constructions
can overflow values that can be represented by an 'int' resulting
in undefined behaviour.  Detect these conditions and return a
range error.
This commit is contained in:
Mark Andrews
2022-07-01 11:40:37 +10:00
committed by Evan Hunt
parent 0b05ee34f0
commit 5327b9708f
2 changed files with 25 additions and 0 deletions

View File

@@ -0,0 +1,18 @@
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
;
; SPDX-License-Identifier: MPL-2.0
;
; This Source Code Form is subject to the terms of the Mozilla Public
; License, v. 2.0. If a copy of the MPL was not distributed with this
; file, you can obtain one at https://mozilla.org/MPL/2.0/.
;
; See the COPYRIGHT file distributed with this work for additional
; information regarding copyright ownership.
$TTL 600
@ SOA ns hostmaster 2011012708 3600 1200 604800 1200
NS ns
ns A 192.0.2.1
; 2147483647 + 1 overflows what can be represented in an 'int'
$GENERATE 1-1 host$ TXT foo${2147483647}

View File

@@ -725,6 +725,13 @@ genname(char *name, int it, char *buffer, size_t length) {
continue;
}
}
/*
* 'it' is >= 0 so we don't need to check for
* underflow.
*/
if ((it > 0 && delta > INT_MAX - it)) {
return (ISC_R_RANGE);
}
if (nibblemode) {
n = nibbles(numbuf, sizeof(numbuf), width,
mode[0], it + delta);