Re: Tracking Heap Corruption bug FIXED!

Eugene Crosser <[email protected]> Sat, 03 Nov 2007 12:08:26 +0300

Newsgroups	gmane.mail.spam.spf.devel
Message-ID	<[email protected]>

David Hinkle wrote:

> ==30539== Invalid write of size 1
> ==30539==    at 0x401BD48: memcpy (in
> /usr/local/lib/valgrind/x86-linux/vgpreload_memcheck.so)
> ==30539==    by 0x4064E74: SPF_dns_resolv_lookup (spf_dns_resolv.c:404)

OK, I think that my change indeed fixes the problem. At least, I do not
see segfaults anymore. Plus, the change looks like a Right Thing (tm) to
me. Please whoever manages the package these days consider applying the
attached diff (and maybe also fixing indentation in the 'while' block).

Eugene

libspf2-1.2.5-segfault-diff (text/plain, 760 B)

--- src/libspf2/spf_dns_resolv.c.orig	2005-02-19 05:38:12.000000000 +0300
+++ src/libspf2/spf_dns_resolv.c	2007-11-03 11:54:03.000000000 +0300
@@ -399,6 +399,10 @@
 				while ( rdlen > 0 )
 				{
 				len = *src;
+				/* zero length element? must be terminator */
+				if (len == 0) break;
+				/* element longer than buffer? corrupt data */
+				if (len >= rdlen) break;
 				src++;
 				memcpy( dst, src, len );
 				dst += len;

-------------------------------------------
-----------------------------------------------------------------------
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to http://v2.listbox.com/member/?member_id=6959932&id_secret=60693347-0ebc78
Powered by Listbox: http://www.listbox.com

signature.asc (application/pgp-signature, 252 B)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHLDqMfrw/cIw6UWkRAngcAJ9DaFe+KuZINlPWm8whcDF5W72ENwCfXs4d
gFDsD8OqL3RRGKOkepSdpvU=
=j6Gb
-----END PGP SIGNATURE-----