r15024@catbus: nickm | 2007-09-10 10:49:15 -0400

 Fix evdns_resolve_reverse_ipv6() so buffer is bug enough, and so the string ends with ".ip6.arpa" rather than "..ip6.arpa".

svn:r427

diff --git a/ChangeLog b/ChangeLog
index dc11e975f0212081162bd23ed2f4ac97660cfabc..1f3fd2e08c9110842e778fb6942b54da952488d3 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,3 +8,4 @@ Changes in current version:
  o Make adding of array members in event_rpcgen more efficient, but doubling memory allocation
  o Fix a memory leak in the DNS server
  o Fix compilation when DNS_USE_OPENSSL_FOR_ID is enabled
+ o Fix buffer size and string generation in evdns_resolve_reverse_ipv6().

diff --git a/evdns.c b/evdns.c
index a7593456ac0deebb4344f7b60f79835b5a594e44..22f9a7a271c0ff36a57d83bfff6cbb112d5fb48d 100644 (file)
--- a/evdns.c
+++ b/evdns.c
@@ -2265,7 +2265,8 @@ int evdns_resolve_reverse(struct in_addr *in, int flags, evdns_callback_type cal
 }
 
 int evdns_resolve_reverse_ipv6(struct in6_addr *in, int flags, evdns_callback_type callback, void *ptr) {
-       char buf[64];
+       /* 32 nybbles, 32 periods, "ip6.arpa", NUL. */
+       char buf[73];
        char *cp;
        struct request *req;
        int i;
@@ -2278,8 +2279,8 @@ int evdns_resolve_reverse_ipv6(struct in6_addr *in, int flags, evdns_callback_ty
                *cp++ = "0123456789abcdef"[byte >> 4];
                *cp++ = '.';
        }
-       assert(cp + strlen(".ip6.arpa") < buf+sizeof(buf));
-       memcpy(cp, ".ip6.arpa", strlen(".ip6.arpa")+1);
+       assert(cp + strlen("ip6.arpa") < buf+sizeof(buf));
+       memcpy(cp, "ip6.arpa", strlen("ip6.arpa")+1);
        log(EVDNS_LOG_DEBUG, "Resolve requested for %s (reverse)", buf);
        req = request_new(TYPE_PTR, buf, flags, callback, ptr);
        if (!req) return 1;