[Asterisk-code-review] dns core: Protect against array index violation. (asterisk[15])

[Jenkins2]

Jenkins2 has submitted this change and it was merged. ( https://gerrit.asterisk.org/7667 )

Change subject: dns_core: Protect against array index violation.
......................................................................

dns_core: Protect against array index violation.

Add a check to allocate_dns_record to prevent calling a pointer
retrieved from beyond dns_alloc_table.

ASTERISK-27495 #close

Change-Id: Ie2f6e4991cea46baa12e837bd64cc22b44d322bb
---
M main/dns_core.c
1 file changed, 6 insertions(+), 2 deletions(-)

Approvals:
  Sean Bright: Looks good to me, but someone else must approve
  Richard Mudgett: Looks good to me, but someone else must approve
  Joshua Colp: Looks good to me, approved
  Jenkins2: Approved for Submit



diff --git a/main/dns_core.c b/main/dns_core.c
index a243b4b..3e270af 100644
--- a/main/dns_core.c
+++ b/main/dns_core.c
@@ -447,9 +447,13 @@
 	[T_SRV] = dns_srv_alloc,
 };
 
-static struct ast_dns_record *allocate_dns_record(int rr_type, struct ast_dns_query *query, const char *data, const size_t size)
+static struct ast_dns_record *allocate_dns_record(unsigned int rr_type, struct ast_dns_query *query, const char *data, const size_t size)
 {
-	dns_alloc_fn allocator = dns_alloc_table[rr_type] ?: generic_record_alloc;
+	dns_alloc_fn allocator = generic_record_alloc;
+
+	if (rr_type < ARRAY_LEN(dns_alloc_table) && dns_alloc_table[rr_type]) {
+		allocator = dns_alloc_table[rr_type];
+	}
 
 	return allocator(query, data, size);
 }

-- 
To view, visit https://gerrit.asterisk.org/7667
To unsubscribe, visit https://gerrit.asterisk.org/settings

Gerrit-Project: asterisk
Gerrit-Branch: 15
Gerrit-MessageType: merged
Gerrit-Change-Id: Ie2f6e4991cea46baa12e837bd64cc22b44d322bb
Gerrit-Change-Number: 7667
Gerrit-PatchSet: 2
Gerrit-Owner: Corey Farrell <git at cfware.com>
Gerrit-Reviewer: Corey Farrell <git at cfware.com>
Gerrit-Reviewer: Jenkins2
Gerrit-Reviewer: Joshua Colp <jcolp at digium.com>
Gerrit-Reviewer: Richard Mudgett <rmudgett at digium.com>
Gerrit-Reviewer: Sean Bright <sean.bright at gmail.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-code-review/attachments/20171220/5bf8f58b/attachment.html>