Subject: Re: [ISC-Bugs #23006] AutoReply: test
In-Reply-To: Your message of "Wed, 26 Jan 2011 10:09:05 -0000." <rt-3.8.6-55512-1296036545-509.23006-4-0@isc.org>
Date: Wed, 26 Jan 2011 23:11:31 +1100
References: <RT-Ticket-23006@isc.org> <AANLkTinvpUr0pppqgeQhPiLaoEFSGBt2-N1rMd3W_QB5@mail.gmail.com> <rt-3.8.6-55512-1296024183-1872.23006-20-0@isc.org> <AANLkTinGi7ft_+NigtBwqk6pDCBQdb-bCwESK+iSZ3hr@mail.gmail.com> <rt-3.8.6-55504-1296025207-1429.23006-5-0@isc.org> <AANLkTikmOsqos1K5ey3TN8VR2mw1mKEEyiZqbZdEAT9g@mail.gmail.com> <rt-3.8.6-55512-1296036545-509.23006-4-0@isc.org>
Content-Type: text/plain; charset="utf-8"
Message-ID: <20110126121131.D3AE692B859@drugs.dv.isc.org>
To: dhcp-bugs@isc.org
From: Mark Andrews <marka@isc.org>
RT-Message-ID: <rt-3.8.6-55510-1296043897-15.23006-0-0@isc.org>
Content-Length: 2365


In message <rt-3.8.6-55512-1296036545-509.23006-4-0@isc.org>, "dave b via RT" w
rites:
> Also,  this is amusing:  ( and I probably got this entirely wrong
> :P - and I doubt it is a real issue)
> 
> dhcpclient.c
> 
> dhcp()
> ...
> char addrbuf[4*16];
> ...
> ...
> The following comment is just plain wrong:
> 
>                         /* piaddr() returns its result in a static
>                            buffer sized 4*16 (see common/inet.c). */
> 
> Why? because sizeof pbuf is 46.
> source:  static char
> pbuf[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")];
> 
> Ok.
> 
> Now in dhcpv6()
> ...
> 
> char addrbuf[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff")];
> the sizeof addrbuf is 40.
> 
> Following along:
> 
>         /* Discard, with log, packets from quenched sources. */
>         for (ap = packet->interface->client->config->reject_list ;
>              ap ; ap = ap->next) {
>                 if (addr_match(&packet->client_addr, &ap->match)) {
> 
>  WOOPS --->  strcpy(addrbuf, piaddr(packet->client_addr));
> 
> 
> 
>                         log_info("%s from %s rejected by rule %s",
>                                  dhcpv6_type_names[packet->dhcpv6_msg_type],
>                                  addrbuf,
>                                  piaddrmask(&ap->match.addr, &ap->match.mask)
> );
>                         return;
>                 }
>         }
> 
> >From the strcpy manual:
> The  strcpy()  function  copies  the  string pointed to by src,
> including the terminating null byte ('\0'), to the buffer  pointed to
> by dest.  The strings may not overlap, and the destination string dest
> must be large  enough  to  receive  the  copy.
> 
> Hum but (for dhcpv6) addrbuf is sizeof 40 and the max of the source
> string is sizeof 46. Woops.

45 is the biggest legal input.  No presentation address exceeds 39.  The
two form where a dotted quad are emitted have the following forms neither
of which is anywhere near 46 bytes in length.

		::111.222.333.444
		::ffff:111.222.333.444

However if a flag was ever added to say emit dotted quad then you would
have arbitary prefixes and it could be reached.


> -- 
> Ticket History: https://bugs.isc.org/Ticket/Display.html?id=23006
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org