merge

[plan9front.git] / sys / src / cmd / ndb / convM2DNS.c

diff --git a/sys/src/cmd/ndb/convM2DNS.c b/sys/src/cmd/ndb/convM2DNS.c
index 047b1bbec0bd29f0ee68f01c0f748bb012643a75..8d35bbddb3131cdcca4c00ce80ec82bab5b500f7 100644 (file)
--- a/sys/src/cmd/ndb/convM2DNS.c
+++ b/sys/src/cmd/ndb/convM2DNS.c
@@ -226,17 +226,21 @@ gname(char *to, RR *rp, Scan *sp)
                goto err;
        pointer = 0;
        p = sp->p;
-       if (p == nil) {
+       if(p == nil) {
                dnslog("gname: %R: nil sp->p", rp);
                goto err;
        }
        toend = to + Domlen;
        for(len = 0; *p && p < sp->ep; len += (pointer? 0: n+1)) {
                n = 0;
-               switch (*p & 0300) {
+               switch(*p & 0300) {
                case 0:                 /* normal label */
-                       if (p < sp->ep)
+                       if(p < sp->ep)
                                n = *p++ & 077;         /* pick up length */
+                       if(sp->ep - p <= n){
+                               sp->err = "bad name length";
+                               goto err;
+                       }
                        if(len + n < Domlen - 1){
                                if(n > toend - to){
                                        errtoolong(rp, sp, toend - to, n,
@@ -345,7 +349,6 @@ retry:
        rp->type = type;
 
        ULONG(rp->ttl);
-       rp->ttl += now;
        USHORT(len);                    /* length of data following */
        data = sp->p;
        assert(data != nil);
@@ -483,7 +486,7 @@ retry:
                if (type == Tcname && sp->p - data == 2 && len == 0)
                        return rp;
                if (len > sp->p - data){
-                       dnslog("bad %s RR len (%d bytes nominal, %lud actual): %R",
+                       dnslog("bad %s RR len (%d bytes nominal, %zud actual): %R",
                                rrname(type, ptype, sizeof ptype), len,
                                sp->p - data, rp);
                        rrfree(rp);