Created attachment 542548 [details]
Patch for RPM build of adns-1.4.tar.gz to fix error in adnsresfilter.c

Description of problem:

The adnsresfilter program will core dump on 32 bit Fedora 15 when run with the "--brackets" option and fed a IP address of 15 characters enclosed in brackets.

Version-Release number of selected component (if applicable):


How reproducible:

Alwas reproducable


Steps to Reproduce:

1. Boot Fedora 15 (32 bit)

2. Install ands-progs package

  yum install adns-progs

3. Feed a string containing a 15 character IP address within brackets into the adnsresfilter program with the --brackets option:

  echo "[255.255.255.255]" | adnsresfilter --unchecked --timeout 1000 --brackets
  
Actual results:

[root@probe-p3p1 ~]# echo "[255.255.255.255]" | adnsresfilter --unchecked --timeout 1000 --brackets
Segmentation fault
[root@probe-p3p1 ~]# 

Expected results:

[root@dev15-32 ~]# echo "[255.255.255.255]" | adnsresfilter --unchecked --timeout 1000 --brackets
[255.255.255.255]
[root@dev15-32 ~]# 

Additional info:

This appears to be a buffer overrun issue in the "client/adnsresfilter.c" source file. The addrtextbuf buffer is used to hold the IP address (and bracket characters) and is declared as:

static char addrtextbuf[14];

However, a IP address like 255.255.255.255 is 15 characters long. When you add brackets it becomes 17 characters long. I fixed the segmentation fault in my local build by allocating 18 bytes (in case a null string terminator might be appended somewhere in the code). Hence to avoid the segmentation fault, I changed the above declaration to:

static char addrtextbuf[18];

I've attached the "patch" file I created to apply this patch to build my own version of the RPM