Fix crash in filter_servers().

The bug occurs when we ask lookup_domain() for a server for a domain
which is not a general upstream server, by setting F_DOMAINSRV in the flags.

If there are no possible servers, because there are no upstream servers
defined (for instance, at startup) then the code steps off the end of an
array and SEGVs.

The bug has been latent for some time, but
3e659bd4ec added a new call to lookup_domain()
which can actually trigger the bug if DNSSEC is enabled and a certain
amount of bad luck ensues.

Thanks to the testers extraordinaire at PiHole for reporting this.

src/dnsmasq.c

@@ -81,7 +81,9 @@ int main (int argc, char **argv)
   int tftp_prefix_missing = 0;
 #endif
 
+#ifdef HAVE_LINUX_NETWORK
   (void)netlink_warn;
+#endif
   
 #if defined(HAVE_IDN) || defined(HAVE_LIBIDN2) || defined(LOCALEDIR)
   setlocale(LC_ALL, "");

src/domain-match.c

@@ -343,10 +343,8 @@ int filter_servers(int seed, int flags, int *lowout, int *highout)
 		      else
 			{
 			  /* If we want a server for a particular domain, and this one isn't, return nothing. */
-			  if ((flags & F_DOMAINSRV) && daemon->serverarray[nlow]->domain_len == 0)
+			  if (nlow != nhigh && (flags & F_DOMAINSRV) && daemon->serverarray[nlow]->domain_len == 0)
 			    nlow = nhigh;
-			  else
-			    nlow = i;
 			}
 		    }
 		}

src/inotify.c

@@ -133,29 +133,44 @@ void inotify_dnsmasq_init()
     }
 }
 
-static struct hostsfile *dyndir_addhosts(struct dyndir *dd, char *path)
+static struct hostsfile *dyndir_addhosts(struct dyndir *dd, char *file)
 {
   /* Check if this file is already known in dd->files */
-  struct hostsfile *ah = NULL;
-  for(ah = dd->files; ah; ah = ah->next)
-    if(ah && ah->fname && strcmp(path, ah->fname) == 0)
+  struct hostsfile *ah;
+  size_t dirlen = sizeof(dd->dname);
+  
+  /* ah->fname always starts with the string in dd->dname */
+  for (ah = dd->files; ah; ah = ah->next)
+    if (ah->fname[dirlen+2] == '/' &&
+        strcmp(&ah->fname[dirlen+3], file) == 0)
       return ah;
-
+  
   /* Not known, create new hostsfile record for this dyndir */
-  struct hostsfile *newah = NULL;
-  if(!(newah = whine_malloc(sizeof(struct hostsfile))))
-    return NULL;
+  if ((ah = whine_malloc(sizeof(struct hostsfile))))
+    {
+      char *path;
 
-  /* Add this file to the tip of the linked list */
-  newah->next = dd->files;
-  dd->files = newah;
-
-  /* Copy flags, set index and the full file path */
-  newah->flags = dd->flags;
-  newah->index = daemon->host_index++;
-  newah->fname = path;
-
-  return newah;
+      if (!(path = whine_malloc(dirlen + strlen(file) + 2)))
+	{
+	  free(ah);
+	  return NULL;
+	}
+      
+      strcpy(path, dd->dname);
+      strcat(path, "/");
+      strcat(path, file);
+      
+      /* Add this file to the tip of the linked list */
+      ah->next = dd->files;
+      dd->files = ah;
+      
+      /* Copy flags, set index and the full file path */
+      ah->flags = dd->flags;
+      ah->index = daemon->host_index++;
+      ah->fname = path;
+    }
+  
+  return ah;
 }
 
 
@@ -204,10 +219,8 @@ void set_dynamic_inotify(int flag, int total_size, struct crec **rhash, int revh
 
        while ((ent = readdir(dir_stream)))
 	 {
-	   size_t lendir = strlen(dd->dname);
 	   size_t lenfile = strlen(ent->d_name);
-	   char *path;
-
+	   	   
 	   /* ignore emacs backups and dotfiles */
 	   if (lenfile == 0 || 
 	       ent->d_name[lenfile - 1] == '~' ||
@@ -215,33 +228,36 @@ void set_dynamic_inotify(int flag, int total_size, struct crec **rhash, int revh
 	       ent->d_name[0] == '.')
 	     continue;
 
-	   if ((path = whine_malloc(lendir + lenfile + 2)))
+	   if (dd->flags & AH_HOSTS)
 	     {
 	       struct hostsfile *ah;
 
-	       strcpy(path, dd->dname);
-	       strcat(path, "/");
-	       strcat(path, ent->d_name);
-
-	       if (!(ah = dyndir_addhosts(dd, path)))
-		 {
-		   free(path);
-		   continue;
-		 }
-	       
 	       /* ignore non-regular files */
-	       if (stat(path, &buf) != -1 && S_ISREG(buf.st_mode))
-		 {
-		   if (dd->flags & AH_HOSTS)
-		     total_size = read_hostsfile(path, ah->index, total_size, rhash, revhashsz);
+	       if ((ah = dyndir_addhosts(dd, ent->d_name)) &&
+		   stat(ah->fname, &buf) != -1 && S_ISREG(buf.st_mode))
+		 total_size = read_hostsfile(ah->fname, ah->index, total_size, rhash, revhashsz);
+	     }
 #ifdef HAVE_DHCP
-		   else if (dd->flags & (AH_DHCP_HST | AH_DHCP_OPT))
+	   else if (dd->flags & (AH_DHCP_HST | AH_DHCP_OPT))
+	     {
+	       char *path;
+	       
+	       if ((path = whine_malloc(strlen(dd->dname) + lenfile + 2)))
+		 {
+		   strcpy(path, dd->dname);
+		   strcat(path, "/");
+		   strcat(path, ent->d_name);
+		   
+		   /* ignore non-regular files */
+		   if (stat(path, &buf) != -1 && S_ISREG(buf.st_mode))
 		     option_read_dynfile(path, dd->flags);
-#endif		   
+		   
+		   free(path);
 		 }
 	     }
+#endif		   
 	 }
-
+       
        closedir(dir_stream);
     }
 }
@@ -285,50 +301,27 @@ int inotify_check(time_t now)
 	  for (dd = daemon->dynamic_dirs; dd; dd = dd->next)
 	    if (dd->wd == in->wd)
 	      {
-		size_t lendir = strlen(dd->dname);
-		char *path;
-				
-		if ((path = whine_malloc(lendir + in->len + 2)))
+		if (dd->flags & AH_HOSTS)
 		  {
-		    struct hostsfile *ah = NULL;
-
-		    strcpy(path, dd->dname);
-		    strcat(path, "/");
-		    strcat(path, in->name);
-
-		    /* Is this is a deletion event? */
-		    if (in->mask & IN_DELETE)
-		      my_syslog(LOG_INFO, _("inotify: %s removed"), path);
-		    else 
-		      my_syslog(LOG_INFO, _("inotify: %s new or modified"), path);
-
-		    if (dd->flags & AH_HOSTS)
+		    struct hostsfile *ah;
+		    if ((ah = dyndir_addhosts(dd, in->name)))
 		      {
-			if ((ah = dyndir_addhosts(dd, path)))
-			  {
-			    const unsigned int removed = cache_remove_uid(ah->index);
-			    if (removed > 0)
-			      my_syslog(LOG_INFO, _("inotify: flushed %u names read from %s"), removed, path);
+			const unsigned int removed = cache_remove_uid(ah->index);
 
-			    /* (Re-)load hostsfile only if this event isn't triggered by deletion */
-			    if (!(in->mask & IN_DELETE))
-			      read_hostsfile(path, ah->index, 0, NULL, 0);
+			/* Is this is a deletion event? */
+			if (in->mask & IN_DELETE)
+			  my_syslog(LOG_INFO, _("inotify: %s removed"), ah->fname);
+			else 
+			  my_syslog(LOG_INFO, _("inotify: %s new or modified"), ah->fname);
+
+			if (removed > 0)
+			  my_syslog(LOG_INFO, _("inotify: flushed %u names read from %s"), removed, ah->fname);
+			
+			/* (Re-)load hostsfile only if this event isn't triggered by deletion */
+			if (!(in->mask & IN_DELETE))
+			  read_hostsfile(ah->fname, ah->index, 0, NULL, 0);
 #ifdef HAVE_DHCP
-			    if (daemon->dhcp || daemon->doing_dhcp6) 
-			      {
-				/* Propagate the consequences of loading a new dhcp-host */
-				dhcp_update_configs(daemon->dhcp_conf);
-				lease_update_from_configs(); 
-				lease_update_file(now); 
-				lease_update_dns(1);
-			      }
-#endif
-			  }
-		      }
-#ifdef HAVE_DHCP
-		    else if (dd->flags & AH_DHCP_HST)
-		      {
-			if (option_read_dynfile(path, AH_DHCP_HST))
+			if (daemon->dhcp || daemon->doing_dhcp6) 
 			  {
 			    /* Propagate the consequences of loading a new dhcp-host */
 			    dhcp_update_configs(daemon->dhcp_conf);
@@ -336,17 +329,43 @@ int inotify_check(time_t now)
 			    lease_update_file(now); 
 			    lease_update_dns(1);
 			  }
-		      }
-		    else if (dd->flags & AH_DHCP_OPT)
-		      option_read_dynfile(path, AH_DHCP_OPT);
 #endif
-		    
-		    if (!ah)
-		      free(path);
+		      }
 		  }
+#ifdef HAVE_DHCP
+		else if (!(in->mask & IN_DELETE))
+		  {
+		    char *path;
+
+		    if ((path = whine_malloc(strlen(dd->dname) + in->len + 2)))
+		      {
+			strcpy(path, dd->dname);
+			strcat(path, "/");
+			strcat(path, in->name);
+			
+			my_syslog(LOG_INFO, _("inotify: %s new or modified"), path);
+
+			if ((dd->flags & AH_DHCP_HST) && option_read_dynfile(path, AH_DHCP_HST))
+			  {
+			    /* Propagate the consequences of loading a new dhcp-host */
+			    dhcp_update_configs(daemon->dhcp_conf);
+			    lease_update_from_configs(); 
+			    lease_update_file(now); 
+			    lease_update_dns(1);
+			  }
+			
+			if (dd->flags & AH_DHCP_OPT)
+			  option_read_dynfile(path, AH_DHCP_OPT);
+		    
+			free(path);
+		      }
+		  }
+#endif
+		
 	      }
 	}
     }
+  
   return hit;
 }
 

src/tftp.c

@@ -198,11 +198,11 @@ static void tftp_request(struct listener *listen, time_t now)
 
       name = namebuff;
       
-      addra.addr4 = addr.in.sin_addr;
-
       if (family == AF_INET6)
 	addra.addr6 = addr.in6.sin6_addr;
-
+      else
+	addra.addr4 = addr.in.sin_addr;
+      
       if (daemon->tftp_interfaces)
 	{
 	  /* dedicated tftp interface list */
@@ -662,7 +662,7 @@ void check_tftp_listeners(time_t now)
       int endcon = 0, error = 0, timeout = 0;
       
       tmp = transfer->next;
-      
+            
       /* ->start set to zero in handle_tftp() when we recv an error packet. */
       if (transfer->start == 0)
 	endcon = error = 1;
@@ -679,22 +679,18 @@ void check_tftp_listeners(time_t now)
 	  /* Do transmission or re-transmission. When we get an ACK, the call to handle_tftp()
 	     bumps transfer->lastack and trips the retransmit timer so that we send the next block(s)
 	     here. */
-	  unsigned int i, winsize;
 	  ssize_t len;
 	  
 	  transfer->retransmit += transfer->timeout + (1<<(transfer->backoff/2));
 	  transfer->backoff++;
 	  transfer->block = transfer->lastack;
-
+	  
 	  if ((len = get_block(daemon->packet, transfer)) == 0)
 	    endcon = 1; /* got last ACK */
 	  else
 	    {
 	      /* send a window'a worth of blocks unless we're retransmitting OACK */
-	      winsize = transfer->block ? transfer->windowsize : 1;
-	      
-	      /* we overwrote the buffer... */
-	      daemon->srv_save = NULL;
+	      unsigned int i, winsize = transfer->block ? transfer->windowsize : 1;
 	      
 	      for (i = 0; i < winsize && !endcon; i++, transfer->block++)
 		{
@@ -860,7 +856,10 @@ static ssize_t tftp_err(int err, char *packet, char *message, char *file, char *
     char message[];
   } *mess = (struct errmess *)packet;
   ssize_t len, ret = 4;
-    
+
+  /* we overwrote the buffer... */
+  daemon->srv_save = NULL;
+
   memset(packet, 0, daemon->packet_buff_sz);
   if (file)
     sanitise(file);
@@ -888,7 +887,10 @@ static ssize_t tftp_err_oops(char *packet, const char *file)
 static ssize_t get_block(char *packet, struct tftp_transfer *transfer)
 {
   memset(packet, 0, daemon->packet_buff_sz);
-  
+
+  /* we overwrote the buffer... */
+  daemon->srv_save = NULL;
+
   if (transfer->block == 0)
     {
       /* send OACK */