From: Nick Mathewson <nickm@torproject.org>
Date: Mon, 10 Sep 2007 14:55:55 +0000 (+0000)
Subject:  r15024@catbus:  nickm | 2007-09-10 10:49:15 -0400
X-Git-Tag: release-2.0.1-alpha~574
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=8b39254926c96587e74ec334f001d17f4d09f4d8;p=libevent

 r15024@catbus:  nickm | 2007-09-10 10:49:15 -0400
 Fix evdns_resolve_reverse_ipv6() so buffer is bug enough, and so the string ends with ".ip6.arpa" rather than "..ip6.arpa".


svn:r427
---

diff --git a/ChangeLog b/ChangeLog
index dc11e975..1f3fd2e0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,3 +8,4 @@ Changes in current version:
  o Make adding of array members in event_rpcgen more efficient, but doubling memory allocation
  o Fix a memory leak in the DNS server
  o Fix compilation when DNS_USE_OPENSSL_FOR_ID is enabled
+ o Fix buffer size and string generation in evdns_resolve_reverse_ipv6().
diff --git a/evdns.c b/evdns.c
index a7593456..22f9a7a2 100644
--- a/evdns.c
+++ b/evdns.c
@@ -2265,7 +2265,8 @@ int evdns_resolve_reverse(struct in_addr *in, int flags, evdns_callback_type cal
 }
 
 int evdns_resolve_reverse_ipv6(struct in6_addr *in, int flags, evdns_callback_type callback, void *ptr) {
-	char buf[64];
+	/* 32 nybbles, 32 periods, "ip6.arpa", NUL. */
+	char buf[73];
 	char *cp;
 	struct request *req;
 	int i;
@@ -2278,8 +2279,8 @@ int evdns_resolve_reverse_ipv6(struct in6_addr *in, int flags, evdns_callback_ty
 		*cp++ = "0123456789abcdef"[byte >> 4];
 		*cp++ = '.';
 	}
-	assert(cp + strlen(".ip6.arpa") < buf+sizeof(buf));
-	memcpy(cp, ".ip6.arpa", strlen(".ip6.arpa")+1);
+	assert(cp + strlen("ip6.arpa") < buf+sizeof(buf));
+	memcpy(cp, "ip6.arpa", strlen("ip6.arpa")+1);
 	log(EVDNS_LOG_DEBUG, "Resolve requested for %s (reverse)", buf);
 	req = request_new(TYPE_PTR, buf, flags, callback, ptr);
 	if (!req) return 1;