mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 14:35:26 +00:00
Code Issues Releases Wiki Activity

Handle large numbers when parsing/printing a duration

Browse Source 
The isccfg_duration_fromtext() function is truncating large numbers
to 32 bits instead of capping or rejecting them, i.e. 64424509445,
which is 0xf00000005, gets parsed as 32-bit value 5 (0x00000005).

Fail parsing a duration if any of its components is bigger than
32 bits. Using those kind of big numbers has no practical use case
for a duration.

The isccfg_duration_toseconds() function can overflow the 32 bit
seconds variable when calculating the duration from its component
parts.

To avoid that, use 64-bit calculation and return UINT32_MAX if the
calculated value is bigger than UINT32_MAX. Again, a number this big
has no practical use case anyway.

The buffer for the generated duration string is limited to 64 bytes,
which, in theory, is smaller than the longest possible generated
duration string.

Use 80 bytes instead, calculated by the '7 x (10 + 1) + 3' formula,
where '7' is the count of the duration's parts (year, month, etc.), '10'
is their maximum length when printed as a decimal number, '1' is their
indicator character (Y, M, etc.), and 3 is two more indicators (P and T)
and the terminating NUL character.
This commit is contained in:
Aram Sargsyan
2022-10-17 08:45:45 +00:00
parent 190aab84d7
commit fddaebb285
3 changed files with 63 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/isccfg/parser.c
View File

@@ -1030,7 +1030,7 @@ numlen(uint32_t num) {
*/
void
cfg_print_duration(cfg_printer_t *pctx, const cfg_obj_t *obj) {
char buf[DURATION_MAXLEN];
char buf[CFG_DURATION_MAXLEN];
char *str;
const char *indicators = "YMWDHMS";
int count, i;
@@ -1085,7 +1085,7 @@ cfg_print_duration(cfg_printer_t *pctx, const cfg_obj_t *obj) {
if (T) {
count++;
}
INSIST(count < DURATION_MAXLEN);
INSIST(count < CFG_DURATION_MAXLEN);
/* Now print the duration. */
for (i = 0; i < 6; i++) {