cvs: php-src(PHP_5_0) / NEWS /ext/standard dns.c

tony2001 Sun Oct 23 14:35:20 2005 EDT Modified files: (Branch: PHP_5_0) /php-src NEWS /php-src/ext/standard dns.c Log: MFH: fix #34938 (dns_get_record() doesn't resolve long hostnames and leaks) http://cvs.php.net/diff.php/php-src/NEWS?r1=1.1760.2.503&r2=1.1760.2.504&ty=u Index: php-src/NEWS diff -u php-src/NEWS:1.1760.2.503 php-src/NEWS:1.1760.2.504 --- php-src/NEWS:1.1760.2.503 Fri Oct 21 05:56:36 2005 +++ php-src/NEWS Sun Oct 23 14:35:19 2005 @@ -4,6 +4,8 @@ - Fixed an error in mysqli_fetch_fields (returned NULL instead of an array when row number > field_count). (Georg) - Renamed CachingRecursiveIterator to RecursiveCachingIterator. (Marcus) +- Fixed bug #34938 (dns_get_record() doesn't resolve long hostnames and + leaks). (Tony) - Fixed bug #34856 (configure fails to detect libiconv's type). (Tony) - Fixed bug #34855 (ibase_service_attach() segfault on AMD64). (irie at gmx dot de, Tony) http://cvs.php.net/diff.php/php-src/ext/standard/dns.c?r1=1.68.2.1&r2=1.68.2.2&ty=u Index: php-src/ext/standard/dns.c diff -u php-src/ext/standard/dns.c:1.68.2.1 php-src/ext/standard/dns.c:1.68.2.2 --- php-src/ext/standard/dns.c:1.68.2.1 Fri Oct 21 09:49:22 2005 +++ php-src/ext/standard/dns.c Sun Oct 23 14:35:20 2005 @@ -18,7 +18,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: dns.c,v 1.68.2.1 2005/10/21 13:49:22 tony2001 Exp $ */ +/* $Id: dns.c,v 1.68.2.2 2005/10/23 18:35:20 tony2001 Exp $ */ /* {{{ includes */ #include "php.h" @@ -307,9 +307,8 @@ #define QFIXEDSZ 4 /* fixed data in query <arpa/nameser.h> */ #endif /* QFIXEDSZ */ -#ifndef MAXHOSTNAMELEN -#define MAXHOSTNAMELEN 256 -#endif /* MAXHOSTNAMELEN */ +#undef MAXHOSTNAMELEN +#define MAXHOSTNAMELEN 1024 #ifndef MAXRESOURCERECORDS #define MAXRESOURCERECORDS 64 @@ -320,10 +319,25 @@ u_char qb2[65536]; } querybuf; +/* just a hack to free resources allocated by glibc in __res_nsend() + * See also: + * res_thread_freeres() in glibc/resolv/res_init.c + * __libc_res_nsend() in resolv/res_send.c + * */ +static void _php_dns_free_res(struct __res_state res) { /* {{{ */ + int ns; + for (ns = 0; ns < MAXNS; ns++) { + if (res._u._ext.nsaddrs[ns] != NULL) { + free (res._u._ext.nsaddrs[ns]); + res._u._ext.nsaddrs[ns] = NULL; + } + } +} /* }}} */ + /* {{{ php_parserr */ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int store, zval **subarray) { - u_short type, class, dlen; + u_short type, dlen; u_long ttl; long n, i; u_short s; @@ -332,14 +346,13 @@ *subarray = NULL; - n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof(name)) - 2); + n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, sizeof(name) - 2); if (n < 0) { return NULL; } cp += n; GETSHORT(type, cp); - GETSHORT(class, cp); GETLONG(ttl, cp); GETSHORT(dlen, cp); if (type_to_fetch != T_ANY && type != type_to_fetch) { @@ -522,7 +535,7 @@ HEADER *hp; querybuf buf, answer; u_char *cp = NULL, *end = NULL; - long n, qd, an, ns = 0, ar = 0; + int n, qd, an, ns = 0, ar = 0; int type, first_query = 1, store_results = 1; switch (ZEND_NUM_ARGS()) { @@ -629,6 +642,7 @@ break; } if (type_to_fetch) { + memset(&res, 0, sizeof(res)); res_ninit(&res); res.retrans = 5; res.options &= ~RES_DEFNAMES; @@ -637,12 +651,16 @@ if (n<0) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "res_nmkquery() failed"); zval_dtor(return_value); + res_nclose(&res); + _php_dns_free_res(res); RETURN_FALSE; } n = res_nsend(&res, buf.qb2, n, answer.qb2, sizeof answer); if (n<0) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "res_nsend() failed"); zval_dtor(return_value); + res_nclose(&res); + _php_dns_free_res(res); RETURN_FALSE; } @@ -660,6 +678,8 @@ if (n < 0) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to parse DNS data received"); zval_dtor(return_value); + res_nclose(&res); + _php_dns_free_res(res); RETURN_FALSE; } cp += n + QFIXEDSZ; @@ -675,6 +695,7 @@ } } res_nclose(&res); + _php_dns_free_res(res); } }