Truncate stupidly large cache sizes.

If the cache size is very large, the malloc() call will overflow
on 32 bit platforms and dnsmasq will crash. Limit to an order of
magnitude less.

Thanks to Lili Xu for spotting this.
This commit is contained in:
Simon Kelley
2019-08-20 23:36:49 +01:00
parent dc6a57ffb8
commit 248efe8410

View File

@@ -2690,6 +2690,14 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
if (size < 0) if (size < 0)
size = 0; size = 0;
/* Note that for very large cache sizes, the malloc()
will overflow. For the size of the cache record
at the time this was noted, the value of "very large"
was 46684428. Limit to an order of magnitude less than
that to be safe from changes to the cache record. */
if (size > 5000000)
size = 5000000;
daemon->cachesize = size; daemon->cachesize = size;
} }