MIME-Version: 1.0
In-Reply-To: <rt-3.8.6-55504-1296025207-1429.23006-5-0@isc.org>
References: <RT-Ticket-23006@isc.org> <AANLkTinvpUr0pppqgeQhPiLaoEFSGBt2-N1rMd3W_QB5@mail.gmail.com> <rt-3.8.6-55512-1296024183-1872.23006-20-0@isc.org> <AANLkTinGi7ft_+NigtBwqk6pDCBQdb-bCwESK+iSZ3hr@mail.gmail.com> <rt-3.8.6-55504-1296025207-1429.23006-5-0@isc.org>
Message-ID: <AANLkTikmOsqos1K5ey3TN8VR2mw1mKEEyiZqbZdEAT9g@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [ISC-Bugs #23006] AutoReply: test
Domainkey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-type; b=xZh52hCeTOhp5vUtqLYy+SBgDSqJR31Vu0KpXaL90WnpV0lRNHZJn344o6koVSNTh6 oAACpARJKd1Az1ec3DRT5P/phH2pnOwpx8QDElq3QdmLS00OLxPU58TOB/Ngo4Jgw3zy QMh2M0q2UzIkRZsUSxGscLsX1ubuomqXITiHY=
Date: Wed, 26 Jan 2011 21:08:28 +1100
To: dhcp-bugs@isc.org
From: dave b <db.pub.mail@gmail.com>
RT-Message-ID: <rt-3.8.6-55512-1296036545-796.23006-0-0@isc.org>
Content-Length: 1589

Also,  this is amusing:  ( and I probably got this entirely wrong
:P - and I doubt it is a real issue)

dhcpclient.c

dhcp()
...
char addrbuf[4*16];
...
...
The following comment is just plain wrong:

                        /* piaddr() returns its result in a static
                           buffer sized 4*16 (see common/inet.c). */

Why? because sizeof pbuf is 46.
source:  static char
pbuf[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")];

Ok.

Now in dhcpv6()
...

char addrbuf[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff")];
the sizeof addrbuf is 40.

Following along:

        /* Discard, with log, packets from quenched sources. */
        for (ap = packet->interface->client->config->reject_list ;
             ap ; ap = ap->next) {
                if (addr_match(&packet->client_addr, &ap->match)) {

 WOOPS --->  strcpy(addrbuf, piaddr(packet->client_addr));


                        log_info("%s from %s rejected by rule %s",
                                 dhcpv6_type_names[packet->dhcpv6_msg_type],
                                 addrbuf,
                                 piaddrmask(&ap->match.addr, &ap->match.mask));
                        return;
                }
        }

From the strcpy manual:
The  strcpy()  function  copies  the  string pointed to by src,
including the terminating null byte ('\0'), to the buffer  pointed to
by dest.  The strings may not overlap, and the destination string dest
must be large  enough  to  receive  the  copy.

Hum but (for dhcpv6) addrbuf is sizeof 40 and the max of the source
string is sizeof 46. Woops.