| Subject: | resolv.conf parsing crashes when parsing sortlist entries |
resconf.c:irs_resconf_load() should initialize conf->sortlistnxt to zero. The value left uniitialized results in invalid writes:
==71351== Memcheck, a memory error detector
==71351== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==71351== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
==71351== Command: dhcp-4.3.5/server/dhcpd -d -cf /home/iscdhcp/toms/toms.conf -lf /home/iscdhcp/toms/dhcpd.leases -T em0
==71351==
Internet Systems Consortium DHCP Server 4.3.5
Copyright 2004-2016 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/
==71351== Invalid write of size 4
==71351== at 0x4C99CE: create_addr (resconf.c:264)
==71351== by 0x4C99CE: resconf_parsesortlist (resconf.c:406)
==71351== by 0x4C99CE: irs_resconf_load (resconf.c:529)
==71351== by 0x4C84A1: dhcp_dns_client_setservers (isclib.c:52)
==71351== by 0x4C8A7F: dhcp_context_create (isclib.c:263)
==71351== by 0x40685C: postconf_initialization (dhcpd.c:1145)
==71351== by 0x404EA6: main (dhcpd.c:711)
==71351== Address 0x59e4ec8 is 35,704 bytes inside an unallocated block of size 146,576 in arena "client"
==71351==
==71351== Invalid write of size 4
==71351== at 0x4C99DB: create_addr (resconf.c:265)
==71351== by 0x4C99DB: resconf_parsesortlist (resconf.c:406)
==71351== by 0x4C99DB: irs_resconf_load (resconf.c:529)
==71351== by 0x4C84A1: dhcp_dns_client_setservers (isclib.c:52)
==71351== by 0x4C8A7F: dhcp_context_create (isclib.c:263)
==71351== by 0x40685C: postconf_initialization (dhcpd.c:1145)
==71351== by 0x404EA6: main (dhcpd.c:711)
==71351== Address 0x59e4ecc is 35,708 bytes inside an unallocated block of size 146,576 in arena "client"
==71351==
==71351== Invalid write of size 4
==71351== at 0x4C99E3: create_addr (resconf.c:266)
==71351== by 0x4C99E3: resconf_parsesortlist (resconf.c:406)
==71351== by 0x4C99E3: irs_resconf_load (resconf.c:529)
==71351== by 0x4C84A1: dhcp_dns_client_setservers (isclib.c:52)
==71351== by 0x4C8A7F: dhcp_context_create (isclib.c:263)
==71351== by 0x40685C: postconf_initialization (dhcpd.c:1145)
==71351== by 0x404EA6: main (dhcpd.c:711)
==71351== Address 0x59e4f34 is 35,812 bytes inside an unallocated block of size 146,576 in arena "client"
==71351==
==71351== Invalid write of size 4
==71351== at 0x4C9A64: create_addr (resconf.c:264)
==71351== by 0x4C9A64: resconf_parsesortlist (resconf.c:411)
==71351== by 0x4C9A64: irs_resconf_load (resconf.c:529)
==71351== by 0x4C84A1: dhcp_dns_client_setservers (isclib.c:52)
==71351== by 0x4C8A7F: dhcp_context_create (isclib.c:263)
==71351== by 0x40685C: postconf_initialization (dhcpd.c:1145)
==71351== by 0x404EA6: main (dhcpd.c:711)
==71351== Address 0x59e4f38 is 35,816 bytes inside an unallocated block of size 146,576 in arena "client"
==71351==
==71351== Invalid write of size 4
==71351== at 0x4C9A71: create_addr (resconf.c:265)
==71351== by 0x4C9A71: resconf_parsesortlist (resconf.c:411)
==71351== by 0x4C9A71: irs_resconf_load (resconf.c:529)
==71351== by 0x4C84A1: dhcp_dns_client_setservers (isclib.c:52)
==71351== by 0x4C8A7F: dhcp_context_create (isclib.c:263)
==71351== by 0x40685C: postconf_initialization (dhcpd.c:1145)
==71351== by 0x404EA6: main (dhcpd.c:711)
==71351== Address 0x59e4f3c is 35,820 bytes inside an unallocated block of size 146,576 in arena "client"
==71351==
==71351== Invalid write of size 4
==71351== at 0x4C9A79: create_addr (resconf.c:270)
==71351== by 0x4C9A79: resconf_parsesortlist (resconf.c:411)
==71351== by 0x4C9A79: irs_resconf_load (resconf.c:529)
==71351== by 0x4C84A1: dhcp_dns_client_setservers (isclib.c:52)
==71351== by 0x4C8A7F: dhcp_context_create (isclib.c:263)
==71351== by 0x40685C: postconf_initialization (dhcpd.c:1145)
==71351== by 0x404EA6: main (dhcpd.c:711)
==71351== Address 0x59e4fa4 is 35,924 bytes inside an unallocated block of size 146,576 in arena "client"
==71351==
Config file: /home/iscdhcp/toms/toms.conf
Database file: /home/iscdhcp/toms/dhcpd.leases
PID file: dhcpd.pid
==71351==
==71351== HEAP SUMMARY:
==71351== in use at exit: 7,036,654 bytes in 463 blocks
==71351== total heap usage: 545 allocs, 82 frees, 7,162,594 bytes allocated
==71351==
==71351== LEAK SUMMARY:
==71351== definitely lost: 2,384 bytes in 1 blocks
==71351== indirectly lost: 0 bytes in 0 blocks
==71351== possibly lost: 4,064 bytes in 1 blocks
==71351== still reachable: 7,030,206 bytes in 461 blocks
==71351== suppressed: 0 bytes in 0 blocks
==71351== Rerun with --leak-check=full to see details of leaked memory
==71351==
==71351== For counts of detected and suppressed errors, rerun with: -v
==71351== ERROR SUMMARY: 18 errors from 6 contexts (suppressed: 39 from 5)