Subject: Re: [PATCH] ares_parse_srv_reply

Re: [PATCH] ares_parse_srv_reply

From: Uli <ToBeSpammed_at_web.de>
Date: Wed, 01 Jul 2009 20:06:55 +0200

Jakub Hrozek wrote:
> +struct srv_reply {
> + int weight;
> + int priority;
> + int port;
> + char *host;
> +};
[..]
> +#define SRV_PRIORITY_SIZE 2
> +#define SRV_WEIGHT_SIZE 2
> +#define SRV_PORT_SIZE 2
[..]
> + memcpy ((void *) &srv[i].priority, aptr, SRV_PRIORITY_SIZE);
> + aptr += SRV_PRIORITY_SIZE;
> + memcpy ((void *) &srv[i].weight, aptr, SRV_WEIGHT_SIZE);
> + aptr += SRV_WEIGHT_SIZE;
> + memcpy ((void *) &srv[i].port, aptr, SRV_PORT_SIZE);
> + aptr += SRV_PORT_SIZE;
Hi,

This looks like it will break badly if those fields aren't 2 byte large (they
aren't) and if the mem isn't initialized to zero (it isn't, allocated via malloc
which doesn't initialize mem).
Oh and I'd expect this to break badly on some endian where it writes to the high
bytes of the "int"s.

Feel free to correct me if I'm wrong.

Cheers,
Uli

-- 
"Do you know that books smell like nutmeg or some spice from a foreign land?"
                                                  -- Faber in Fahrenheit 451
Received on 2009-07-01