From: Bert Hubert <bert.hubert@netherlabs.nl>
Date: Tue, 7 Nov 2006 08:39:47 +0000 (+0000)
Subject: fix possible TCP related crash on malformed packet
X-Git-Tag: rec-3.1.4~6
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a0aa4f64f207d20a049d5b1c76255df30bac71ff;p=pdns

fix possible TCP related crash on malformed packet


git-svn-id: svn://svn.powerdns.com/pdns/trunk/pdns@915 d19b8d6e-7fed-0310-83ef-9ca221ded41b
---

diff --git a/pdns/pdns_recursor.cc b/pdns/pdns_recursor.cc
index d12b40ab4..67f0ae672 100644
--- a/pdns/pdns_recursor.cc
+++ b/pdns/pdns_recursor.cc
@@ -652,7 +652,7 @@ void handleRunningTCPQuestion(int fd, boost::any& var)
     if(bytes==1)
       conn->state=TCPConnection::BYTE1;
     if(bytes==2) { 
-      conn->qlen=(conn->data[0]<<8)+conn->data[1];
+      conn->qlen=(((unsigned char)conn->data[0]) << 8)+ (unsigned char)conn->data[1];
       conn->bytesread=0;
       conn->state=TCPConnection::GETQUESTION;
     }
@@ -664,10 +664,10 @@ void handleRunningTCPQuestion(int fd, boost::any& var)
     }
   }
   else if(conn->state==TCPConnection::BYTE1) {
-    int bytes=recv(conn->fd,conn->data+1,1,0);
+    int bytes=recv(conn->fd, conn->data+1, 1, 0);
     if(bytes==1) {
       conn->state=TCPConnection::GETQUESTION;
-      conn->qlen=(conn->data[0]<<8)+conn->data[1];
+      conn->qlen=(((unsigned char)conn->data[0]) << 8)+ (unsigned char)conn->data[1];
       conn->bytesread=0;
     }
     if(!bytes || bytes < 0) {
@@ -680,7 +680,7 @@ void handleRunningTCPQuestion(int fd, boost::any& var)
     }
   }
   else if(conn->state==TCPConnection::GETQUESTION) {
-    int bytes=recv(conn->fd,conn->data + conn->bytesread,conn->qlen - conn->bytesread, 0);
+    int bytes=recv(conn->fd, conn->data + conn->bytesread, conn->qlen - conn->bytesread, 0);
     if(!bytes || bytes < 0) {
       L<<Logger::Error<<"TCP client "<< conn->remote.toString() <<" disconnected while reading question body"<<endl;
       TCPConnection tmp(*conn);