Updates from http://www.isc.org/products/BIND/patches/bind4910.diff

 o check __dn_skipname() return value for errors
 o fix sanity checking of reverse records, getnetbyname() may not
   have been working before.

1 files changed, 37 insertions, 22 deletions

diff --git a/lib/libc/net/getnetnamadr.c b/lib/libc/net/getnetnamadr.c
index abbfdbd64c2..f183fbe3fef 100644
--- a/lib/libc/net/getnetnamadr.c
+++ b/lib/libc/net/getnetnamadr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: getnetnamadr.c,v 1.18 2002/08/27 08:53:13 itojun Exp $	*/
+/*	$OpenBSD: getnetnamadr.c,v 1.19 2002/11/14 02:48:00 millert Exp $	*/
 
 /*
  * Copyright (c) 1997, Jason Downs.  All rights reserved.
@@ -77,7 +77,7 @@ static char sccsid[] = "@(#)getnetbyaddr.c	8.1 (Berkeley) 6/4/93";
 static char sccsid_[] = "from getnetnamadr.c	1.4 (Coimbra) 93/06/03";
 static char rcsid[] = "$From: getnetnamadr.c,v 8.7 1996/08/05 08:31:35 vixie Exp $";
 #else
-static char rcsid[] = "$OpenBSD: getnetnamadr.c,v 1.18 2002/08/27 08:53:13 itojun Exp $";
+static char rcsid[] = "$OpenBSD: getnetnamadr.c,v 1.19 2002/11/14 02:48:00 millert Exp $";
 #endif
 #endif /* LIBC_SCCS and not lint */
 
@@ -133,7 +133,7 @@ getnetanswer(answer, anslen, net_i)
 	int type, class, ancount, qdcount, haveanswer, i, nchar;
 	char aux1[MAXHOSTNAMELEN], aux2[MAXHOSTNAMELEN], ans[MAXHOSTNAMELEN];
 	char *in, *st, *pauxt, *bp, **ap, *ep;
-	char *paux1 = &aux1[0], *paux2 = &aux2[0], flag = 0;
+	char *paux1 = &aux1[0], *paux2 = &aux2[0];
 	static	struct netent net_entry;
 	static	char *net_aliases[MAXALIASES], netbuf[BUFSIZ+1];
 
@@ -165,8 +165,14 @@ getnetanswer(answer, anslen, net_i)
 			h_errno = TRY_AGAIN;
 		return (NULL);
 	}
-	while (qdcount-- > 0)
-		cp += __dn_skipname(cp, eom) + QFIXEDSZ;
+	while (qdcount-- > 0) {
+		n = __dn_skipname(cp, eom);
+		if (n < 0 || (cp + n + QFIXEDSZ) > eom) {
+			h_errno = NO_RECOVERY;
+			return(NULL);
+		}
+		cp += n + QFIXEDSZ;
+	}
 	ap = net_aliases;
 	*ap = NULL;
 	net_entry.n_aliases = net_aliases;
@@ -198,11 +204,13 @@ getnetanswer(answer, anslen, net_i)
 				return (NULL);
 			}
 			cp += n; 
-			*ap++ = bp;
-			bp += strlen(bp) + 1;
-			net_entry.n_addrtype =
-				(class == C_IN) ? AF_INET : AF_UNSPEC;
-			haveanswer++;
+			if ((ap + 2) < &net_aliases[MAXALIASES]) {
+				*ap++ = bp;
+				bp += strlen(bp) + 1;
+				net_entry.n_addrtype =
+					(class == C_IN) ? AF_INET : AF_UNSPEC;
+				haveanswer++;
+			}
 		}
 	}
 	if (haveanswer) {
@@ -213,25 +221,32 @@ getnetanswer(answer, anslen, net_i)
 			net_entry.n_net = 0L;
 			break;
 		case BYNAME:
-			in = *net_entry.n_aliases;
-			net_entry.n_name = &ans[0];
+			ap = net_entry.n_aliases;
+		next_alias:
+			in = *ap++;
+			if (in == NULL) {
+				h_errno = HOST_NOT_FOUND;
+				return (NULL);
+			}
+			net_entry.n_name = ans;
 			aux2[0] = '\0';
 			for (i = 0; i < 4; i++) {
 				for (st = in, nchar = 0;
-				     *st != '.';
+				     isdigit((unsigned char)*st);
 				     st++, nchar++)
 					;
-				if (nchar != 1 || *in != '0' || flag) {
-					flag = 1;
-					strlcpy(paux1, 
-						(i==0) ? in : in-1, 
-						(i==0) ? nchar+1 : nchar+2);
-					pauxt = paux2;
-					paux2 = strcat(paux1, paux2);
-					paux1 = pauxt;
-				}
+				if (*st != '.' || nchar == 0 || nchar > 3)
+					goto next_alias;
+				if (i != 0)
+					nchar++;
+				strlcpy(paux1, in, nchar+1);
+				pauxt = paux2;
+				paux2 = strcat(paux1, paux2);
+				paux1 = pauxt;
 				in = ++st;
 			}		  
+			if (strcasecmp(in, "IN-ADDR.ARPA") != 0)
+				goto next_alias;
 			net_entry.n_net = inet_network(paux2);
 			break;
 		}