]> granicus.if.org Git - pdns/commitdiff
dnsdist: Don't access the TCP buffer vector past its size
authorRemi Gacogne <remi.gacogne@powerdns.com>
Tue, 5 Jun 2018 22:10:13 +0000 (00:10 +0200)
committerRemi Gacogne <remi.gacogne@powerdns.com>
Tue, 5 Jun 2018 22:10:36 +0000 (00:10 +0200)
The required memory has been reserve()'d, but we are not allowed to
access it directly, and it breaks when compiled with the following
flag, checking any access to containers as if .at() were used:

-D_GLIBCXX_ASSERTIONS

pdns/dnsdist-tcp.cc

index 0eb7ea1396ec2dc2c45c01ff31949d4d770d77fa..ab2bda916c06247f67da007c8eaa893dd1a15393 100644 (file)
@@ -315,7 +315,7 @@ void* tcpClientThread(int pipefd)
         bool ecsAdded = false;
         /* allocate a bit more memory to be able to spoof the content,
            or to add ECS without allocating a new buffer */
-        queryBuffer.reserve(qlen + 512);
+        queryBuffer.resize(qlen + 512);
 
         char* query = &queryBuffer[0];
         handler.read(query, qlen, g_tcpRecvTimeout, remainingTime);
@@ -358,7 +358,7 @@ void* tcpClientThread(int pipefd)
        uint16_t qtype, qclass;
        unsigned int consumed = 0;
        DNSName qname(query, qlen, sizeof(dnsheader), false, &qtype, &qclass, &consumed);
-       DNSQuestion dq(&qname, qtype, qclass, &dest, &ci.remote, dh, queryBuffer.capacity(), qlen, true, &queryRealTime);
+       DNSQuestion dq(&qname, qtype, qclass, &dest, &ci.remote, dh, queryBuffer.size(), qlen, true, &queryRealTime);
 
        if (!processQuery(holders, dq, poolname, &delayMsec, now)) {
          goto drop;