BIND 10 trac1452, updated. 4d5f96b4d083f8ba171bc90e5767ea89e2dc98c6 [1452] impose upper limit on the data length for SocketSessionForwarder::push, too.

[BIND 10 source code commits]

The branch, trac1452 has been updated
       via  4d5f96b4d083f8ba171bc90e5767ea89e2dc98c6 (commit)
      from  1e4d796212bc7c91def18e9edd838c92b042e6b1 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 4d5f96b4d083f8ba171bc90e5767ea89e2dc98c6
Author: JINMEI Tatuya <jinmei at isc.org>
Date:   Tue Dec 13 15:06:29 2011 -0800

    [1452] impose upper limit on the data length for SocketSessionForwarder::push,
    too.

-----------------------------------------------------------------------

Summary of changes:
 src/lib/util/io/socketsession.cc             |   10 ++++++++--
 src/lib/util/tests/socketsession_unittest.cc |    7 +++++++
 2 files changed, 15 insertions(+), 2 deletions(-)

-----------------------------------------------------------------------
diff --git a/src/lib/util/io/socketsession.cc b/src/lib/util/io/socketsession.cc
index af871c7..8dbdf78 100644
--- a/src/lib/util/io/socketsession.cc
+++ b/src/lib/util/io/socketsession.cc
@@ -179,6 +179,10 @@ SocketSessionForwarder::push(int sock, int family, int sock_type, int protocol,
         isc_throw(SocketSessionError,
                   "Data for a socket session must not be empty");
     }
+    if (data_len > MAX_DATASIZE) {
+        isc_throw(SocketSessionError, "Invalid socket session data size: " <<
+                  data_len << ", must not exceed " << MAX_DATASIZE);
+    }
 
     if (send_fd(impl_->fd_, sock) != 0) {
         isc_throw(SocketSessionError, "FD passing failed: " <<
@@ -198,8 +202,10 @@ SocketSessionForwarder::push(int sock, int family, int sock_type, int protocol,
     // Remote endpoint
     impl_->buf_.writeUint32(static_cast<uint32_t>(getSALength(remote_end)));
     impl_->buf_.writeData(&remote_end, getSALength(remote_end));
-    // Data length
-    impl_->buf_.writeUint32(static_cast<uint32_t>(data_len));
+    // Data length.  Must be fit uint32 due to the range check above.
+    const uint32_t data_len32 = static_cast<uint32_t>(data_len);
+    assert(data_len == data_len32); // shouldn't cause overflow.
+    impl_->buf_.writeUint32(data_len32);
     // Write the resulting header length at the beginning of the buffer
     impl_->buf_.writeUint16At(impl_->buf_.getLength() - sizeof(uint16_t), 0);
 
diff --git a/src/lib/util/tests/socketsession_unittest.cc b/src/lib/util/tests/socketsession_unittest.cc
index e5380bf..717b0cd 100644
--- a/src/lib/util/tests/socketsession_unittest.cc
+++ b/src/lib/util/tests/socketsession_unittest.cc
@@ -626,6 +626,13 @@ TEST_F(ForwarderTest, badPush) {
                                  NULL, sizeof(TEST_DATA)),
                  SocketSessionError);
 
+    // Too big data: we reject them at least for now
+    EXPECT_THROW(forwarder_.push(1, AF_INET, SOCK_DGRAM, IPPROTO_UDP,
+                                 *getSockAddr("192.0.2.1", "53").first,
+                                 *getSockAddr("192.0.2.2", "53").first,
+                                 string(65536, 'd').c_str(), 65536),
+                 SocketSessionError);
+
     // Close the receptor before push.  It will result in SIGPIPE (should be
     // ignored) and EPIPE, which will be converted to SocketSessionError.
     const int receptor_fd = acceptForwarder();