From 5099491894024f3ff575bcc3a71c4ce1f6bc615b Mon Sep 17 00:00:00 2001
From: Raimo Niskanen <raimo@erlang.org>
Date: Thu, 27 May 2010 10:34:48 +0200
Subject: Resolver: stop inet_res leaking ports

Bugfix: when all nameservers return a reply causing decode errors
or when errors enetunreach or econnrefused occured while
contacting them, one or two UDP ports was leaked i.e
left open and forgotten.
---
 lib/kernel/src/inet_res.erl | 1 +
 1 file changed, 1 insertion(+)

(limited to 'lib')

diff --git a/lib/kernel/src/inet_res.erl b/lib/kernel/src/inet_res.erl
index 9b9e078898..fb8a5f3e71 100644
--- a/lib/kernel/src/inet_res.erl
+++ b/lib/kernel/src/inet_res.erl
@@ -592,6 +592,7 @@ query_retries(_Q, _NSs, _Timer, Retry, Retry, S) ->
 query_retries(Q, NSs, Timer, Retry, I, S0) ->
     Num = length(NSs),
     if Num =:= 0 ->
+	    udp_close(S0),
 	    {error,timeout};
        true ->
 	    case query_nss(Q, NSs, Timer, Retry, I, S0, []) of
-- 
cgit v1.2.3


From 93ba7ad9beae7132c810550e4acdb69a7295d2f9 Mon Sep 17 00:00:00 2001
From: Raimo Niskanen <raimo@erlang.org>
Date: Thu, 27 May 2010 10:38:00 +0200
Subject: Resolver: make inet_dns decode ugly truncated reply

Bugfix: a DNS reply with the truncation bit set containing
misleading section length (i.e header claimed length greater
than what was actually in the reply section) in the header
caused decode error in inet_dns.
---
 lib/kernel/src/inet_dns.erl | 34 ++++++++++++++++++++++------------
 1 file changed, 22 insertions(+), 12 deletions(-)

(limited to 'lib')

diff --git a/lib/kernel/src/inet_dns.erl b/lib/kernel/src/inet_dns.erl
index 669a361c9d..20a9c8055f 100644
--- a/lib/kernel/src/inet_dns.erl
+++ b/lib/kernel/src/inet_dns.erl
@@ -129,27 +129,33 @@ do_decode(<<Id:16,
 	   RA:1,PR:1,_:2,Rcode:4,
 	   QdCount:16,AnCount:16,NsCount:16,ArCount:16,
 	   QdBuf/binary>>=Buffer) ->
-    {AnBuf,QdList} = decode_query_section(QdBuf,QdCount,Buffer),
-    {NsBuf,AnList} = decode_rr_section(AnBuf,AnCount,Buffer),
-    {ArBuf,NsList} = decode_rr_section(NsBuf,NsCount,Buffer),
-    {Rest,ArList} = decode_rr_section(ArBuf,ArCount,Buffer),
+    {AnBuf,QdList,QdTC} = decode_query_section(QdBuf,QdCount,Buffer),
+    {NsBuf,AnList,AnTC} = decode_rr_section(AnBuf,AnCount,Buffer),
+    {ArBuf,NsList,NsTC} = decode_rr_section(NsBuf,NsCount,Buffer),
+    {Rest,ArList,ArTC} = decode_rr_section(ArBuf,ArCount,Buffer),
 	case Rest of
 	    <<>> ->
+		HdrTC = decode_boolean(TC),
 		DnsHdr =
 		    #dns_header{id=Id,
 				qr=decode_boolean(QR),
 				opcode=decode_opcode(Opcode),
 				aa=decode_boolean(AA),
-				tc=decode_boolean(TC),
+				tc=HdrTC,
 				rd=decode_boolean(RD),
 				ra=decode_boolean(RA),
 				pr=decode_boolean(PR),
 				rcode=Rcode},
-		#dns_rec{header=DnsHdr,
-			 qdlist=QdList,
-			 anlist=AnList,
-			 nslist=NsList,
-			 arlist=ArList};
+		case QdTC or AnTC or NsTC or ArTC of
+		    true when not HdrTC ->
+			throw(?DECODE_ERROR);
+		    _ ->
+			#dns_rec{header=DnsHdr,
+				 qdlist=QdList,
+				 anlist=AnList,
+				 nslist=NsList,
+				 arlist=ArList}
+		end;
 	    _ ->
 		%% Garbage data after DNS message
 		throw(?DECODE_ERROR)
@@ -161,8 +167,10 @@ do_decode(_) ->
 decode_query_section(Bin, N, Buffer) ->
     decode_query_section(Bin, N, Buffer, []).
 
+decode_query_section(<<>>=Rest, N, _Buffer, Qs) ->
+    {Rest,reverse(Qs),N =/= 0};
 decode_query_section(Rest, 0, _Buffer, Qs) ->
-    {Rest,reverse(Qs)};
+    {Rest,reverse(Qs),false};
 decode_query_section(Bin, N, Buffer, Qs) ->
     case decode_name(Bin, Buffer) of
 	{<<Type:16,Class:16,Rest/binary>>,Name} ->
@@ -179,8 +187,10 @@ decode_query_section(Bin, N, Buffer, Qs) ->
 decode_rr_section(Bin, N, Buffer) ->
     decode_rr_section(Bin, N, Buffer, []).
 
+decode_rr_section(<<>>=Rest, N, _Buffer, RRs) ->
+    {Rest,reverse(RRs),N =/= 0};
 decode_rr_section(Rest, 0, _Buffer, RRs) ->
-    {Rest,reverse(RRs)};
+    {Rest,reverse(RRs),false};
 decode_rr_section(Bin, N, Buffer, RRs) ->
     case decode_name(Bin, Buffer) of
 	{<<T:16/unsigned,C:16/unsigned,TTL:4/binary,
-- 
cgit v1.2.3