git:master:59234b8f: core: dns cache - safety check for out of bounds index - sr-dev

27 Jul 2017

Module: kamailio
Branch: master
Commit: 59234b8fae1295455e347e27519813e63bf8ffb0
URL: https://github.com/kamailio/kamailio/commit/59234b8fae1295455e347e27519813e6...
Author: Daniel-Constantin Mierla miconda@gmail.com
Committer: Daniel-Constantin Mierla miconda@gmail.com
Date: 2017-07-27T18:20:12+02:00
core: dns cache - safety check for out of bounds index
---
Modified: src/core/dns_cache.c
---
Diff:  https://github.com/kamailio/kamailio/commit/59234b8fae1295455e347e27519813e6...
Patch: https://github.com/kamailio/kamailio/commit/59234b8fae1295455e347e27519813e6...
---

diff --git a/src/core/dns_cache.c b/src/core/dns_cache.c
index e8bfd7f5e6..8c054e0e54 100644
--- a/src/core/dns_cache.c
+++ b/src/core/dns_cache.c
@@ -2333,19 +2333,30 @@ inline static struct dns_rr* dns_srv_get_nxt_rr(struct dns_hash_entry* e,
     * extra checks */
    for (i=0; (i<idx) && (r_sums[i].r_sum<rand_w); i++);
 found:
+	if(i<MAX_SRV_GRP_IDX) {
 #ifdef DNS_CACHE_DEBUG
-	LM_DBG("(%p, %lx, %d, %u): selected %d/%d in grp. %d"
-			" (rand_w=%d, rr=%p rd=%p p=%d w=%d rsum=%d)\n",
-		e, (unsigned long)*tried, *no, now, i, idx, n, rand_w, r_sums[i].rr,
-		(r_sums[i].rr)?r_sums[i].rr->rdata:0,
-		(r_sums[i].rr&&r_sums[i].rr->rdata)?((struct srv_rdata*)r_sums[i].rr->rdata)->priority:0,
-		(r_sums[i].rr&&r_sums[i].rr->rdata)?((struct srv_rdata*)r_sums[i].rr->rdata)->weight:0,
-		r_sums[i].r_sum);
+		LM_DBG("(%p, %lx, %d, %u): selected %d/%d in grp. %d"
+			   " (rand_w=%d, rr=%p rd=%p p=%d w=%d rsum=%d)\n",
+				e, (unsigned long)*tried, *no, now, i, idx, n, rand_w,
+				r_sums[i].rr, (r_sums[i].rr) ? r_sums[i].rr->rdata : 0,
+				(r_sums[i].rr && r_sums[i].rr->rdata)
+						? ((struct srv_rdata *)r_sums[i].rr->rdata)->priority
+						: 0,
+				(r_sums[i].rr && r_sums[i].rr->rdata)
+						? ((struct srv_rdata *)r_sums[i].rr->rdata)->weight
+						: 0,
+				r_sums[i].r_sum);
 #endif
-	/* i is the winner */
-	*no=n; /* grp. start */
-	if(i<8*sizeof(*tried)) srv_mark_tried(tried, i); /* mark it */
-	return r_sums[i].rr;
+		/* i is the winner */
+		*no = n; /* grp. start */
+		if(i < 8 * sizeof(*tried))
+			srv_mark_tried(tried, i); /* mark it */
+		return r_sums[i].rr;
+	} else {
+		LM_WARN("index out of bounds\n");
+		*no=n;
+		return 0;
+	}
 no_more_rrs:
    *no=n;
    return 0;

    