- Larry Lansing fixed ares_parse_srv_reply to properly parse replies

  which might contain non-SRV answers, skipping over potential non-SRV
  ones such as CNAMEs.

4 files changed, 21 insertions, 15 deletions

diff --git a/ares/CHANGES b/ares/CHANGES
index 0782e04c2..a942db501 100644
--- a/ares/CHANGES
+++ b/ares/CHANGES
@@ -1,5 +1,10 @@
   Changelog for the c-ares project
 
+* November 26, 2009 (Yang Tse)
+- Larry Lansing fixed ares_parse_srv_reply to properly parse replies
+  which might contain non-SRV answers, skipping over potential non-SRV
+  ones such as CNAMEs.
+
 * November 23, 2009 (Yang Tse)
 - Changed naming convention for c-ares libraries built with MSVC, details
   and build instructions provided in README.msvc file.
diff --git a/ares/RELEASE-NOTES b/ares/RELEASE-NOTES
index bad430032..040d93ed4 100644
--- a/ares/RELEASE-NOTES
+++ b/ares/RELEASE-NOTES
@@ -31,6 +31,6 @@ Fixed:
 Thanks go to these friendly people for their efforts and contributions:
 
  Phil Blundell, Japheth Cleaver, Yang Tse, Gregor Jasny, Joshua Kwan,
- Timo Teras, Jakub Hrozek, John Engelhart
+ Timo Teras, Jakub Hrozek, John Engelhart, Larry Lansing
 
 Have fun!
diff --git a/ares/ares_parse_srv_reply.c b/ares/ares_parse_srv_reply.c
index 2e5095e04..de723f393 100644
--- a/ares/ares_parse_srv_reply.c
+++ b/ares/ares_parse_srv_reply.c
@@ -56,7 +56,7 @@ ares_parse_srv_reply (const unsigned char *abuf, int alen,
                       struct ares_srv_reply **srv_out)
 {
   unsigned int qdcount, ancount, i;
-  const unsigned char *aptr;
+  const unsigned char *aptr, *vptr;
   int status, rr_type, rr_class, rr_len;
   long len;
   char *hostname = NULL, *rr_name = NULL;
@@ -139,24 +139,25 @@ ares_parse_srv_reply (const unsigned char *abuf, int alen,
             }
           srv_last = srv_curr;
 
-          srv_curr->priority = ntohs (*((unsigned short *)aptr));
-          aptr += sizeof(unsigned short);
-          srv_curr->weight = ntohs (*((unsigned short *)aptr));
-          aptr += sizeof(unsigned short);
-          srv_curr->port = ntohs (*((unsigned short *)aptr));
-          aptr += sizeof(unsigned short);
+          vptr = aptr;
+          srv_curr->priority = ntohs (*((unsigned short *)vptr));
+          vptr += sizeof(unsigned short);
+          srv_curr->weight = ntohs (*((unsigned short *)vptr));
+          vptr += sizeof(unsigned short);
+          srv_curr->port = ntohs (*((unsigned short *)vptr));
+          vptr += sizeof(unsigned short);
 
-          status = ares_expand_name (aptr, abuf, alen, &srv_curr->host, &len);
+          status = ares_expand_name (vptr, abuf, alen, &srv_curr->host, &len);
           if (status != ARES_SUCCESS)
             break;
-
-          /* Move on to the next record */
-          aptr += len;
         }
 
       /* Don't lose memory in the next iteration */
       free (rr_name);
       rr_name = NULL;
+
+      /* Move on to the next record */
+      aptr += rr_len;
     }
 
   if (hostname)
diff --git a/ares/ares_parse_txt_reply.c b/ares/ares_parse_txt_reply.c
index 6583ffb35..8e24e63b7 100644
--- a/ares/ares_parse_txt_reply.c
+++ b/ares/ares_parse_txt_reply.c
@@ -172,14 +172,14 @@ ares_parse_txt_reply (const unsigned char *abuf, int alen,
             }
           /* Make sure we NULL-terminate */
           *((char *) txt_curr->txt + txt_curr->length) = '\0';
-
-          /* Move on to the next record */
-          aptr += rr_len;
         }
 
       /* Don't lose memory in the next iteration */
       free (rr_name);
       rr_name = NULL;
+
+      /* Move on to the next record */
+      aptr += rr_len;
     }
 
   if (hostname)