[sr-dev] git:master:59234b8f: core: dns cache - safety check for out of bounds index

Module: kamailio Branch: master Commit: 59234b8fae1295455e347e27519813e63bf8ffb0 URL: https://github.com/kamailio/kamailio/commit/59234b8fae1295455e347e27519813e… Author: Daniel-Constantin Mierla &lt;miconda(a)gmail.com&gt; Committer: Daniel-Constantin Mierla &lt;miconda(a)gmail.com&gt; Date: 2017-07-27T18:20:12+02:00 core: dns cache - safety check for out of bounds index --- Modified: src/core/dns_cache.c --- Diff: https://github.com/kamailio/kamailio/commit/59234b8fae1295455e347e27519813e… Patch: https://github.com/kamailio/kamailio/commit/59234b8fae1295455e347e27519813e… --- diff --git a/src/core/dns_cache.c b/src/core/dns_cache.c index e8bfd7f5e6..8c054e0e54 100644 --- a/src/core/dns_cache.c +++ b/src/core/dns_cache.c @@ -2333,19 +2333,30 @@ inline static struct dns_rr* dns_srv_get_nxt_rr(struct dns_hash_entry* e, * extra checks */ for (i=0; (i<idx) && (r_sums[i].r_sum<rand_w); i++); found: + if(i<MAX_SRV_GRP_IDX) { #ifdef DNS_CACHE_DEBUG - LM_DBG("(%p, %lx, %d, %u): selected %d/%d in grp. %d" - " (rand_w=%d, rr=%p rd=%p p=%d w=%d rsum=%d)\n", - e, (unsigned long)*tried, *no, now, i, idx, n, rand_w, r_sums[i].rr, - (r_sums[i].rr)?r_sums[i].rr->rdata:0, - (r_sums[i].rr&&r_sums[i].rr->rdata)?((struct srv_rdata*)r_sums[i].rr->rdata)->priority:0, - (r_sums[i].rr&&r_sums[i].rr->rdata)?((struct srv_rdata*)r_sums[i].rr->rdata)->weight:0, - r_sums[i].r_sum); + LM_DBG("(%p, %lx, %d, %u): selected %d/%d in grp. %d" + " (rand_w=%d, rr=%p rd=%p p=%d w=%d rsum=%d)\n", + e, (unsigned long)*tried, *no, now, i, idx, n, rand_w, + r_sums[i].rr, (r_sums[i].rr) ? r_sums[i].rr->rdata : 0, + (r_sums[i].rr && r_sums[i].rr->rdata) + ? ((struct srv_rdata *)r_sums[i].rr->rdata)->priority + : 0, + (r_sums[i].rr && r_sums[i].rr->rdata) + ? ((struct srv_rdata *)r_sums[i].rr->rdata)->weight + : 0, + r_sums[i].r_sum); #endif - /* i is the winner */ - *no=n; /* grp. start */ - if(i<8*sizeof(*tried)) srv_mark_tried(tried, i); /* mark it */ - return r_sums[i].rr; + /* i is the winner */ + *no = n; /* grp. start */ + if(i < 8 * sizeof(*tried)) + srv_mark_tried(tried, i); /* mark it */ + return r_sums[i].rr; + } else { + LM_WARN("index out of bounds\n"); + *no=n; + return 0; + } no_more_rrs: *no=n; return 0;