Update.

1998-05-28 00:53  Zack Weinberg  <zack@rabi.phys.columbia.edu>

	* glibcbug.in: Send to bugs@gnu or libc-alpha@cygnus depending
	on whether this is a stable release or not (keeps snapshot bug
	reports out of the database).

	* include/libc-symbols.h: Use __ASSEMBLER__ test macro not ASSEMBLER.
	* sysdeps/arm/sysdep.h: Likewise.
	* sysdeps/i386/sysdep.h: Likewise.
	* sysdeps/m68k/sysdep.h: Likewise.
	* sysdeps/mach/mips/sysdep.h: Likewise.
	* sysdeps/mach/sys/reboot.h: Likewise.
	* sysdeps/mach/sysdep.h: Likewise.
	* sysdeps/unix/alpha/sysdep.h: Likewise.
	* sysdeps/unix/bsd/hp/m68k/sysdep.h: Likewise.
	* sysdeps/unix/bsd/osf/alpha/sysdep.h: Likewise.
	* sysdeps/unix/bsd/sequent/i386/sysdep.h: Likewise.
	* sysdeps/unix/bsd/sony/newsos/m68k/sysdep.h: Likewise.
	* sysdeps/unix/bsd/sun/m68k/sysdep.h: Likewise.
	* sysdeps/unix/bsd/vax/sysdep.h: Likewise.
	* sysdeps/unix/i386/sysdep.h: Likewise.
	* sysdeps/unix/mips/sysdep.h: Likewise.
	* sysdeps/unix/sparc/sysdep.h: Likewise.
	* sysdeps/unix/sysv/linux/alpha/sysdep.h: Likewise.
	* sysdeps/unix/sysv/linux/arm/sysdep.h: Likewise.
	* sysdeps/unix/sysv/linux/i386/sysdep.h: Likewise.
	* sysdeps/unix/sysv/linux/m68k/sysdep.h: Likewise.
	* sysdeps/unix/sysv/linux/powerpc/sysdep.h: Likewise.
	* sysdeps/unix/sysv/linux/sparc/sparc32/sysdep.h: Likewise.
	* sysdeps/unix/sysv/linux/sparc/sparc64/sysdep.h: Likewise.
	* sysdeps/unix/sysv/sysv4/solaris2/sparc/sysdep.h: Likewise.

1998-05-27  Mark Kettenis  <kettenis@phys.uva.nl>

	* mach/Machrules: Use $(move-if-change).

1998-05-27  Mark Kettenis  <kettenis@phys.uva.nl>

	* Makeconfig [elf=yes] (+interp): New variable, set to interp.os.
	* Makerules (lib%.so): Depend on $(+interp).
	(libc.so): Add interp.os to list of dependencies.
	(interp-obj): Remove variable.
	* mach/Machrules (+interp): Define to empty since libhurduser and
	libmachuser don't need to have the interpreter set.

1998-05-28  Andreas Jaeger  <aj@arthur.rhein-neckar.de>

	* resolv/res_send.c: Security fixes from bind 4.9.7-REL.

	* resolv/gethnamaddr.c: Likewise.

	* resolv/res_comp.c: Likewise.

1998-05-28  Mark Kettenis  <kettenis@phys.uva.nl>

	* sysdeps/mach/hurd/wait4.c (__wait4): Use ANSI-style definition
	so that transparent union works.

ChangeLog

@@ -1,3 +1,61 @@
+1998-05-28 00:53  Zack Weinberg  <zack@rabi.phys.columbia.edu>
+
+	* glibcbug.in: Send to bugs@gnu or libc-alpha@cygnus depending
+	on whether this is a stable release or not (keeps snapshot bug
+	reports out of the database).
+
+	* include/libc-symbols.h: Use __ASSEMBLER__ test macro not ASSEMBLER.
+	* sysdeps/arm/sysdep.h: Likewise.
+	* sysdeps/i386/sysdep.h: Likewise.
+	* sysdeps/m68k/sysdep.h: Likewise.
+	* sysdeps/mach/mips/sysdep.h: Likewise.
+	* sysdeps/mach/sys/reboot.h: Likewise.
+	* sysdeps/mach/sysdep.h: Likewise.
+	* sysdeps/unix/alpha/sysdep.h: Likewise.
+	* sysdeps/unix/bsd/hp/m68k/sysdep.h: Likewise.
+	* sysdeps/unix/bsd/osf/alpha/sysdep.h: Likewise.
+	* sysdeps/unix/bsd/sequent/i386/sysdep.h: Likewise.
+	* sysdeps/unix/bsd/sony/newsos/m68k/sysdep.h: Likewise.
+	* sysdeps/unix/bsd/sun/m68k/sysdep.h: Likewise.
+	* sysdeps/unix/bsd/vax/sysdep.h: Likewise.
+	* sysdeps/unix/i386/sysdep.h: Likewise.
+	* sysdeps/unix/mips/sysdep.h: Likewise.
+	* sysdeps/unix/sparc/sysdep.h: Likewise.
+	* sysdeps/unix/sysv/linux/alpha/sysdep.h: Likewise.
+	* sysdeps/unix/sysv/linux/arm/sysdep.h: Likewise.
+	* sysdeps/unix/sysv/linux/i386/sysdep.h: Likewise.
+	* sysdeps/unix/sysv/linux/m68k/sysdep.h: Likewise.
+	* sysdeps/unix/sysv/linux/powerpc/sysdep.h: Likewise.
+	* sysdeps/unix/sysv/linux/sparc/sparc32/sysdep.h: Likewise.
+	* sysdeps/unix/sysv/linux/sparc/sparc64/sysdep.h: Likewise.
+	* sysdeps/unix/sysv/sysv4/solaris2/sparc/sysdep.h: Likewise.
+
+1998-05-27  Mark Kettenis  <kettenis@phys.uva.nl>
+
+	* mach/Machrules: Use $(move-if-change).
+
+1998-05-27  Mark Kettenis  <kettenis@phys.uva.nl>
+
+	* Makeconfig [elf=yes] (+interp): New variable, set to interp.os.
+	* Makerules (lib%.so): Depend on $(+interp).
+	(libc.so): Add interp.os to list of dependencies.
+	(interp-obj): Remove variable.
+	* mach/Machrules (+interp): Define to empty since libhurduser and
+	libmachuser don't need to have the interpreter set.
+
+1998-05-28  Andreas Jaeger  <aj@arthur.rhein-neckar.de>
+
+	* resolv/res_send.c: Security fixes from bind 4.9.7-REL.
+
+	* resolv/gethnamaddr.c: Likewise.
+
+	* resolv/res_comp.c: Likewise.
+
+1998-05-28  Mark Kettenis  <kettenis@phys.uva.nl>
+
+	* sysdeps/mach/hurd/wait4.c (__wait4): Use ANSI-style definition
+	so that transparent union works.
+
 1998-05-29 08:58  Ulrich Drepper  <drepper@cygnus.com>
 
 	* manual/texinfo.tex: Update to last available version.

Makeconfig

@@ -457,6 +457,7 @@ ifeq ($(elf),yes)
 +postinit = $(addprefix $(csu-objpfx),crtn.o)
 +prector = `$(CC) --print-file-name=crtbegin.o`
 +postctor = `$(CC) --print-file-name=crtend.o`
++interp = $(addprefix $(elf-objpfx),interp.os)
 endif
 csu-objpfx = $(common-objpfx)csu/
 elf-objpfx = $(common-objpfx)elf/

Makerules

@@ -335,15 +335,9 @@ endif
 # build shared libraries in place from the installed *_pic.a files.
 # $(LDLIBS-%.so) may contain -l switches to generate run-time dependencies
 # on other shared objects.
-lib%.so: lib%_pic.a $(+preinit) $(+postinit)
+lib%.so: lib%_pic.a $(+preinit) $(+postinit) $(+interp)
 	$(build-shlib)
 
-ifeq ($(elf),yes)
-interp-obj = $(common-objpfx)elf/interp.os
-$(common-objpfx)libc.so: $(interp-obj)
-$(patsubst %,$(objpfx)%.so,$(extra-libs)): $(interp-obj)
-endif
-
 define build-shlib
 $(LINK.o) -shared -o $@ $(sysdep-LDFLAGS) $(config-LDFLAGS)  \
 	  -B$(csu-objpfx) $(load-map-file) \
@@ -390,7 +384,8 @@ $(common-objpfx)libc_pic.os: $(common-objpfx)libc_pic.a
 # Use our own special initializer and finalizer files for libc.so.
 $(common-objpfx)libc.so: $(elfobjdir)/soinit.os \
 			 $(common-objpfx)libc_pic.os \
-			 $(elfobjdir)/sofini.os $(elfobjdir)/ld.so \
+			 $(elfobjdir)/sofini.os \
+			 $(elfobjdir)/interp.os $(elfobjdir)/ld.so \
 			 $(..)libc.map
 	$(build-shlib)
 common-generated += libc.so libc_pic.os

glibcbug.in

@@ -6,7 +6,7 @@
 #       these variables are filled in by configure
 #
 VERSION="@VERSION@"
-BUGGLIBC="bugs@gnu.org"
+RELEASE="@RELEASE@"
 ADDONS="@subdirs@"
 HOST="@host@"
 CC='@CC@'
@@ -35,6 +35,12 @@ if test $? -ne 0; then
   chmod 600 $TEMPx
 fi
 
+if test "$RELEASE" = "stable"; then
+  BUGGLIBC="bugs@gnu.org"
+else
+  BUGGLIBC="libc-alpha@cygnus.com"
+fi
+
 BUGADDR=${1-$BUGGLIBC}
 
 : ${EDITOR=emacs}

include/libc-symbols.h

@@ -56,7 +56,7 @@
 
 */
 
-#ifndef	ASSEMBLER
+#ifndef	__ASSEMBLER__
 
 /* Define the macros `_' and `N_' for conveniently marking translatable
    strings in the libc source code.  */
@@ -109,7 +109,7 @@ extern const char _libc_intl_domainname[];
 # define strong_alias_asm(original, alias)	\
   ASM_GLOBAL_DIRECTIVE C_SYMBOL_NAME (alias);	\
   .set C_SYMBOL_NAME (alias),C_SYMBOL_NAME (original)
-# ifdef ASSEMBLER
+# ifdef __ASSEMBLER__
 #  define strong_alias(original, alias)	strong_alias_asm (original, alias)
 # else
 #  define strong_alias(original, alias)	\
@@ -120,7 +120,7 @@ extern const char _libc_intl_domainname[];
 # define strong_alias_asm(original, alias)	\
   ASM_GLOBAL_DIRECTIVE C_SYMBOL_NAME (alias);	\
   C_SYMBOL_NAME (alias) = C_SYMBOL_NAME (original)
-# ifdef ASSEMBLER
+# ifdef __ASSEMBLER__
 #  define strong_alias(original, alias)	strong_alias_asm (original, alias)
 # else
 #  define strong_alias(original, alias)	\
@@ -136,7 +136,7 @@ extern const char _libc_intl_domainname[];
 
 #ifdef HAVE_WEAK_SYMBOLS
 
-# ifdef ASSEMBLER
+# ifdef __ASSEMBLER__
 
 #  ifdef HAVE_ASM_WEAKEXT_DIRECTIVE
 
@@ -164,7 +164,7 @@ extern const char _libc_intl_domainname[];
 
 #  endif /* ! HAVE_ASM_WEAKEXT_DIRECTIVE */
 
-# else /* ! ASSEMBLER */
+# else /* ! __ASSEMBLER__ */
 
 #  ifdef HAVE_ASM_WEAKEXT_DIRECTIVE
 #   define weak_extern_asm(symbol) asm (".weakext " __SYMBOL_PREFIX #symbol);
@@ -180,14 +180,14 @@ extern const char _libc_intl_domainname[];
 #  define weak_alias(o, a) weak_alias_asm (o, a)
 #  define weak_extern(symbol) weak_extern_asm (symbol)
 
-# endif /* ! ASSEMBLER */
+# endif /* ! __ASSEMBLER__ */
 #else
 # define weak_alias(original, alias) strong_alias(original, alias)
 # define weak_extern(symbol)	/* Do nothing; the ref will be strong.  */
 #endif
 
 
-#if (!defined ASSEMBLER && \
+#if (!defined __ASSEMBLER__ && \
      (__GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 7)))
 /* GCC 2.7 and later has special syntax for weak symbols and aliases.
    Using that is better when possible, because the compiler and assembler
@@ -207,7 +207,7 @@ extern const char _libc_intl_domainname[];
 #  define weak_const_function __attribute__ ((weak, __const__))
 
 # endif	/* HAVE_WEAK_SYMBOLS.  */
-#endif	/* Not ASSEMBLER, and GCC 2.7 or later.  */
+#endif	/* Not __ASSEMBLER__, and GCC 2.7 or later.  */
 
 
 #ifndef weak_function
@@ -326,7 +326,7 @@ extern const char _libc_intl_domainname[];
 #endif	/* Have GNU ld.  */
 
 #if DO_VERSIONING
-# ifdef ASSEMBLER
+# ifdef __ASSEMBLER__
 #  define symbol_version(real, name, version) \
      .symver real, name##@##version
 #  define default_symbol_version(real, name, version) \

mach/Machrules

@@ -114,7 +114,7 @@ $(patsubst %,$(objpfx)%.ustamp,$(user-interfaces)): $(objpfx)%.ustamp:
 	       -server /dev/null -user /dev/null -header /dev/null
 	for call in $($*-calls); do \
 	  $(transform-user-stub) \
-	  ../move-if-change $(objpfx)$(transform-user-stub-output)_$${call}.c \
+	  $(move-if-change) $(objpfx)$(transform-user-stub-output)_$${call}.c \
 			    $(objpfx)RPC_$${call}.c; \
 	done
 	touch $@
@@ -211,8 +211,9 @@ extra-libs += $(interface-library)
 # Avoid -lmachuser requiring -lc, which may not be built yet.  If the
 # shared object is absent, ld may choose a static library someplace and
 # produce a bogus libmachuser.so.
-+preinit = 
++preinit =
-+postinit = 
++postinit =
++interp =
 interface.so = $(interface-library:lib%=%.so)
 LDFLAGS-$(interface.so) = -nostdlib -nostartfiles
 

resolv/gethnamaddr.c

@@ -160,6 +160,24 @@ dprintf(msg, num)
 # define dprintf(msg, num) /*nada*/
 #endif
 
+#define BOUNDED_INCR(x) \
+	do { \
+		cp += x; \
+		if (cp > eom) { \
+			__set_h_errno (NO_RECOVERY); \
+			return (NULL); \
+		} \
+	} while (0)
+
+#define BOUNDS_CHECK(ptr, count) \
+	do { \
+		if ((ptr) + (count) > eom) { \
+			__set_h_errno (NO_RECOVERY); \
+			return (NULL); \
+		} \
+	} while (0)
+
+
 static struct hostent *
 getanswer(answer, anslen, qname, qtype)
 	const querybuf *answer;
@@ -170,7 +188,7 @@ getanswer(answer, anslen, qname, qtype)
 	register const HEADER *hp;
 	register const u_char *cp;
 	register int n;
-	const u_char *eom;
+	const u_char *eom, *erdata;
 	char *bp, **ap, **hap;
 	int type, class, buflen, ancount, qdcount;
 	int haveanswer, had_error;
@@ -201,7 +219,8 @@ getanswer(answer, anslen, qname, qtype)
 	qdcount = ntohs(hp->qdcount);
 	bp = hostbuf;
 	buflen = sizeof hostbuf;
-	cp = answer->buf + HFIXEDSZ;
+	cp = answer->buf;
+	BOUNDED_INCR(HFIXEDSZ);
 	if (qdcount != 1) {
 		__set_h_errno (NO_RECOVERY);
 		return (NULL);
@@ -211,7 +230,7 @@ getanswer(answer, anslen, qname, qtype)
 		__set_h_errno (NO_RECOVERY);
 		return (NULL);
 	}
-	cp += n + QFIXEDSZ;
+	BOUNDED_INCR(n + QFIXEDSZ);
 	if (qtype == T_A || qtype == T_AAAA) {
 		/* res_send() has already verified that the query name is the
 		 * same as the one we sent; this just gets the expanded name
@@ -243,12 +262,15 @@ getanswer(answer, anslen, qname, qtype)
 			continue;
 		}
 		cp += n;			/* name */
+		BOUNDS_CHECK(cp, 3 * INT16SZ + INT32SZ);
 		type = _getshort(cp);
  		cp += INT16SZ;			/* type */
 		class = _getshort(cp);
  		cp += INT16SZ + INT32SZ;	/* class, TTL */
 		n = _getshort(cp);
 		cp += INT16SZ;			/* len */
+		BOUNDS_CHECK(cp, n);
+		erdata = cp + n;
 		if (class != C_IN) {
 			/* XXX - debug? syslog? */
 			cp += n;
@@ -263,6 +285,10 @@ getanswer(answer, anslen, qname, qtype)
 				continue;
 			}
 			cp += n;
+			if (cp != erdata) {
+				__set_h_errno (NO_RECOVERY);
+				return (NULL);
+			}
 			/* Store alias. */
 			*ap++ = bp;
 			n = strlen(bp) + 1;	/* for the \0 */
@@ -291,6 +317,10 @@ getanswer(answer, anslen, qname, qtype)
 				continue;
 			}
 			cp += n;
+			if (cp != erdata) {
+				__set_h_errno (NO_RECOVERY);
+				return (NULL);
+			}
 			/* Get canonical name. */
 			n = strlen(tbuf) + 1;	/* for the \0 */
 			if (n > buflen || n >= MAXHOSTNAMELEN) {
@@ -326,6 +356,10 @@ getanswer(answer, anslen, qname, qtype)
 			}
 #if MULTI_PTRS_ARE_ALIASES
 			cp += n;
+			if (cp != erdata) {
+				__set_h_errno (NO_RECOVERY);
+				return (NULL);
+			}
 			if (!haveanswer)
 				host.h_name = bp;
 			else if (ap < &host_aliases[MAXALIASES-1])
@@ -397,6 +431,10 @@ getanswer(answer, anslen, qname, qtype)
 			bp += n;
 			buflen -= n;
 			cp += n;
+			if (cp != erdata) {
+				__set_h_errno (NO_RECOVERY);
+				return (NULL);
+			}
 			break;
 		default:
 			abort();

resolv/res_comp.c

@@ -63,9 +63,10 @@ static char rcsid[] = "$Id$";
 #include <netinet/in.h>
 #include <arpa/nameser.h>
 
-#include <stdio.h>
-#include <resolv.h>
 #include <ctype.h>
+#include <errno.h>
+#include <resolv.h>
+#include <stdio.h>
 
 #if defined(BSD) && (BSD >= 199103)
 # include <unistd.h>
@@ -74,8 +75,17 @@ static char rcsid[] = "$Id$";
 # include "../conf/portability.h"
 #endif
 
-static int	dn_find __P((u_char *exp_dn, u_char *msg,
+static int	ns_name_ntop __P((const u_char *, char *, size_t));
-			     u_char **dnptrs, u_char **lastdnptr));
+static int	ns_name_pton __P((const char *, u_char *, size_t));
+static int	ns_name_unpack __P((const u_char *, const u_char *,
+				    const u_char *, u_char *, size_t));
+static int	ns_name_pack __P((const u_char *, u_char *, int,
+				  const u_char **, const u_char **));
+static int	ns_name_uncompress __P((const u_char *, const u_char *,
+					const u_char *, char *, size_t));
+static int	ns_name_compress __P((const char *, u_char *, size_t,
+				      const u_char **, const u_char **));
+static int	ns_name_skip __P((const u_char **, const u_char *));
 
 /*
  * Expand compressed domain name 'comp_dn' to full domain name.
@@ -85,261 +95,51 @@ static int	dn_find __P((u_char *exp_dn, u_char *msg,
  * Return size of compressed name or -1 if there was an error.
  */
 int
-dn_expand(msg, eomorig, comp_dn, exp_dn, length)
+dn_expand(msg, eom, src, dst, dstsiz)
-	const u_char *msg, *eomorig, *comp_dn;
+	const u_char *msg;
-	char *exp_dn;
+	const u_char *eom;
-	int length;
+	const u_char *src;
+	char *dst;
+	int dstsiz;
 {
-	register const u_char *cp;
+	int n = ns_name_uncompress(msg, eom, src, dst, (size_t)dstsiz);
-	register char *dn;
-	register int n, c;
-	char *eom;
-	int len = -1, checked = 0, octets = 0;
 
-	dn = exp_dn;
+	if (n > 0 && dst[0] == '.')
-	cp = comp_dn;
+		dst[0] = '\0';
-	eom = exp_dn + length;
+	return (n);
-	/*
-	 * fetch next label in domain name
-	 */
-	while (n = *cp++) {
-		/*
-		 * Check for indirection
-		 */
-		switch (n & INDIR_MASK) {
-		case 0:
-			octets += (n + 1);
-			if (octets > MAXCDNAME)
-				return (-1);
-			if (dn != exp_dn) {
-				if (dn >= eom)
-					return (-1);
-				*dn++ = '.';
-			}
-			if (dn+n >= eom)
-				return (-1);
-			checked += n + 1;
-			while (--n >= 0) {
-				if (((c = *cp++) == '.') || (c == '\\')) {
-					if (dn + n + 2 >= eom)
-						return (-1);
-					*dn++ = '\\';
-				}
-				*dn++ = c;
-				if (cp >= eomorig)	/* out of range */
-					return (-1);
-			}
-			break;
-
-		case INDIR_MASK:
-			if (len < 0)
-				len = cp - comp_dn + 1;
-			cp = msg + (((n & 0x3f) << 8) | (*cp & 0xff));
-			if (cp < msg || cp >= eomorig)	/* out of range */
-				return (-1);
-			checked += 2;
-			/*
-			 * Check for loops in the compressed name;
-			 * if we've looked at the whole message,
-			 * there must be a loop.
-			 */
-			if (checked >= eomorig - msg)
-				return (-1);
-			break;
-
-		default:
-			return (-1);			/* flag error */
-		}
-	}
-	*dn = '\0';
-	if (len < 0)
-		len = cp - comp_dn;
-	return (len);
 }
 
 /*
- * Compress domain name 'exp_dn' into 'comp_dn'.
+ * Pack domain name 'exp_dn' in presentation form into 'comp_dn'.
  * Return the size of the compressed name or -1.
  * 'length' is the size of the array pointed to by 'comp_dn'.
- * 'dnptrs' is a list of pointers to previous compressed names. dnptrs[0]
- * is a pointer to the beginning of the message. The list ends with NULL.
- * 'lastdnptr' is a pointer to the end of the array pointed to
- * by 'dnptrs'. Side effect is to update the list of pointers for
- * labels inserted into the message as we compress the name.
- * If 'dnptr' is NULL, we don't try to compress names. If 'lastdnptr'
- * is NULL, we don't update the list.
  */
 int
-dn_comp(exp_dn, comp_dn, length, dnptrs, lastdnptr)
+dn_comp(src, dst, dstsiz, dnptrs, lastdnptr)
-	const char *exp_dn;
+	const char *src;
-	u_char *comp_dn, **dnptrs, **lastdnptr;
+	u_char *dst;
-	int length;
+	int dstsiz;
+	u_char **dnptrs;
+	u_char **lastdnptr;
 {
-	register u_char *cp, *dn;
+	return (ns_name_compress(src, dst, (size_t)dstsiz,
-	register int c, l;
+				 (const u_char **)dnptrs,
-	u_char **cpp, **lpp, *sp, *eob;
+				 (const u_char **)lastdnptr));
-	u_char *msg;
-
-	dn = (u_char *)exp_dn;
-	cp = comp_dn;
-	if (length > MAXCDNAME)
-		length = MAXCDNAME;
-	eob = cp + length;
-	lpp = cpp = NULL;
-	if (dnptrs != NULL) {
-		if ((msg = *dnptrs++) != NULL) {
-			for (cpp = dnptrs; *cpp != NULL; cpp++)
-				;
-			lpp = cpp;	/* end of list to search */
-		}
-	} else
-		msg = NULL;
-	for (c = *dn++; c != '\0'; ) {
-		/* look to see if we can use pointers */
-		if (msg != NULL) {
-			if ((l = dn_find(dn-1, msg, dnptrs, lpp)) >= 0) {
-				if (cp+1 >= eob)
-					return (-1);
-				*cp++ = (l >> 8) | INDIR_MASK;
-				*cp++ = l % 256;
-				return (cp - comp_dn);
-			}
-			/* not found, save it */
-			if (lastdnptr != NULL && cpp < lastdnptr-1) {
-				*cpp++ = cp;
-				*cpp = NULL;
-			}
-		}
-		sp = cp++;	/* save ptr to length byte */
-		do {
-			if (c == '.') {
-				c = *dn++;
-				break;
-			}
-			if (c == '\\') {
-				if ((c = *dn++) == '\0')
-					break;
-			}
-			if (cp >= eob) {
-				if (msg != NULL)
-					*lpp = NULL;
-				return (-1);
-			}
-			*cp++ = c;
-		} while ((c = *dn++) != '\0');
-		/* catch trailing '.'s but not '..' */
-		if ((l = cp - sp - 1) == 0 && c == '\0') {
-			cp--;
-			break;
-		}
-		if (l <= 0 || l > MAXLABEL) {
-			if (msg != NULL)
-				*lpp = NULL;
-			return (-1);
-		}
-		*sp = l;
-	}
-	if (cp >= eob) {
-		if (msg != NULL)
-			*lpp = NULL;
-		return (-1);
-	}
-	*cp++ = '\0';
-	return (cp - comp_dn);
 }
 
 /*
  * Skip over a compressed domain name. Return the size or -1.
  */
 int
-__dn_skipname(comp_dn, eom)
+__dn_skipname(ptr, eom)
-	const u_char *comp_dn, *eom;
+	const u_char *ptr;
+	const u_char *eom;
 {
-	register const u_char *cp;
+	const u_char *saveptr = ptr;
-	register int n;
 
-	cp = comp_dn;
+	if (ns_name_skip(&ptr, eom) == -1)
-	while (cp < eom && (n = *cp++)) {
-		/*
-		 * check for indirection
-		 */
-		switch (n & INDIR_MASK) {
-		case 0:			/* normal case, n == len */
-			cp += n;
-			continue;
-		case INDIR_MASK:	/* indirection */
-			cp++;
-			break;
-		default:		/* illegal type */
-			return (-1);
-		}
-		break;
-	}
-	if (cp > eom)
 		return (-1);
-	return (cp - comp_dn);
+	return (ptr - saveptr);
-}
-
-static int
-mklower(ch)
-	register int ch;
-{
-	if (isascii(ch) && isupper(ch))
-		return (tolower(ch));
-	return (ch);
-}
-
-/*
- * Search for expanded name from a list of previously compressed names.
- * Return the offset from msg if found or -1.
- * dnptrs is the pointer to the first name on the list,
- * not the pointer to the start of the message.
- */
-static int
-dn_find(exp_dn, msg, dnptrs, lastdnptr)
-	u_char *exp_dn, *msg;
-	u_char **dnptrs, **lastdnptr;
-{
-	register u_char *dn, *cp, **cpp;
-	register int n;
-	u_char *sp;
-
-	for (cpp = dnptrs; cpp < lastdnptr; cpp++) {
-		dn = exp_dn;
-		sp = cp = *cpp;
-		while (n = *cp++) {
-			/*
-			 * check for indirection
-			 */
-			switch (n & INDIR_MASK) {
-			case 0:		/* normal case, n == len */
-				while (--n >= 0) {
-					if (*dn == '.')
-						goto next;
-					if (*dn == '\\')
-						dn++;
-					if (mklower(*dn++) != mklower(*cp++))
-						goto next;
-				}
-				if ((n = *dn++) == '\0' && *cp == '\0')
-					return (sp - msg);
-				if (n == '.')
-					continue;
-				goto next;
-
-			case INDIR_MASK:	/* indirection */
-				cp = msg + (((n & 0x3f) << 8) | *cp);
-				break;
-
-			default:	/* illegal type */
-				return (-1);
-			}
-		}
-		if (*dn == '\0')
-			return (sp - msg);
-	next:	;
-	}
-	return (-1);
 }
 
 /*
@@ -510,3 +310,645 @@ __putlong(l, msgp)
 {
 	PUTLONG(l, msgp);
 }
+
+/* ++ From BIND 8.1.1. ++ */
+/*
+ * Copyright (c) 1996 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+ * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+ * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+/*"Id: ns_name.c,v 1.1 1997/12/13 02:41:13 vixie Exp vixie"*/
+
+/*#include "port_before.h"*/
+
+/*#include <sys/types.h>*/
+
+/*#include <netinet/in.h>*/
+/*#include <arpa/nameser.h>*/
+
+/*#include <errno.h>*/
+/*#include <resolv.h>*/
+/*#include <string.h>*/
+
+/*#include "port_after.h"*/
+
+#define NS_CMPRSFLGS	0xc0	/* Flag bits indicating name compression. */
+#define NS_MAXCDNAME	255	/* maximum compressed domain name */
+
+/* Data. */
+
+static char		digits[] = "0123456789";
+
+/* Forward. */
+
+static int		special(int);
+static int		printable(int);
+static int		dn_find(const u_char *, const u_char *,
+				const u_char * const *,
+				const u_char * const *);
+
+/* Public. */
+
+/*
+ * ns_name_ntop(src, dst, dstsiz)
+ *	Convert an encoded domain name to printable ascii as per RFC1035.
+ * return:
+ *	Number of bytes written to buffer, or -1 (with errno set)
+ * notes:
+ *	The root is returned as "."
+ *	All other domains are returned in non absolute form
+ */
+static int
+ns_name_ntop(src, dst, dstsiz)
+	const u_char *src;
+	char *dst;
+	size_t dstsiz;
+{
+	const u_char *cp;
+	char *dn, *eom;
+	u_char c;
+	u_int n;
+
+	cp = src;
+	dn = dst;
+	eom = dst + dstsiz;
+
+	while ((n = *cp++) != 0) {
+		if ((n & NS_CMPRSFLGS) != 0) {
+			/* Some kind of compression pointer. */
+			__set_errno (EMSGSIZE);
+			return (-1);
+		}
+		if (dn != dst) {
+			if (dn >= eom) {
+				__set_errno (EMSGSIZE);
+				return (-1);
+			}
+			*dn++ = '.';
+		}
+		if (dn + n >= eom) {
+			__set_errno (EMSGSIZE);
+			return (-1);
+		}
+		for ((void)NULL; n > 0; n--) {
+			c = *cp++;
+			if (special(c)) {
+				if (dn + 1 >= eom) {
+					__set_errno (EMSGSIZE);
+					return (-1);
+				}
+				*dn++ = '\\';
+				*dn++ = (char)c;
+			} else if (!printable(c)) {
+				if (dn + 3 >= eom) {
+					__set_errno (EMSGSIZE);
+					return (-1);
+				}
+				*dn++ = '\\';
+				*dn++ = digits[c / 100];
+				*dn++ = digits[(c % 100) / 10];
+				*dn++ = digits[c % 10];
+			} else {
+				if (dn >= eom) {
+					__set_errno (EMSGSIZE);
+					return (-1);
+				}
+				*dn++ = (char)c;
+			}
+		}
+	}
+	if (dn == dst) {
+		if (dn >= eom) {
+			__set_errno (EMSGSIZE);
+			return (-1);
+		}
+		*dn++ = '.';
+	}
+	if (dn >= eom) {
+		__set_errno (EMSGSIZE);
+		return (-1);
+	}
+	*dn++ = '\0';
+	return (dn - dst);
+}
+
+/*
+ * ns_name_pton(src, dst, dstsiz)
+ *	Convert a ascii string into an encoded domain name as per RFC1035.
+ * return:
+ *	-1 if it fails
+ *	1 if string was fully qualified
+ *	0 is string was not fully qualified
+ * notes:
+ *	Enforces label and domain length limits.
+ */
+
+static int
+ns_name_pton(src, dst, dstsiz)
+	const char *src;
+	u_char *dst;
+	size_t dstsiz;
+{
+	u_char *label, *bp, *eom;
+	int c, n, escaped;
+	char *cp;
+
+	escaped = 0;
+	bp = dst;
+	eom = dst + dstsiz;
+	label = bp++;
+
+	while ((c = *src++) != 0) {
+		if (escaped) {
+			if ((cp = strchr(digits, c)) != NULL) {
+				n = (cp - digits) * 100;
+				if ((c = *src++) == 0 ||
+				    (cp = strchr(digits, c)) == NULL) {
+					__set_errno (EMSGSIZE);
+					return (-1);
+				}
+				n += (cp - digits) * 10;
+				if ((c = *src++) == 0 ||
+				    (cp = strchr(digits, c)) == NULL) {
+					__set_errno (EMSGSIZE);
+					return (-1);
+				}
+				n += (cp - digits);
+				if (n > 255) {
+					__set_errno (EMSGSIZE);
+					return (-1);
+				}
+				c = n;
+			}
+			escaped = 0;
+		} else if (c == '\\') {
+			escaped = 1;
+			continue;
+		} else if (c == '.') {
+			c = (bp - label - 1);
+			if ((c & NS_CMPRSFLGS) != 0) {	/* Label too big. */
+				__set_errno (EMSGSIZE);
+				return (-1);
+			}
+			if (label >= eom) {
+				__set_errno (EMSGSIZE);
+				return (-1);
+			}
+			*label = c;
+			/* Fully qualified ? */
+			if (*src == '\0') {
+				if (c != 0) {
+					if (bp >= eom) {
+						__set_errno (EMSGSIZE);
+						return (-1);
+					}
+					*bp++ = '\0';
+				}
+				if ((bp - dst) > MAXCDNAME) {
+					__set_errno (EMSGSIZE);
+					return (-1);
+				}
+				return (1);
+			}
+			if (c == 0) {
+				__set_errno (EMSGSIZE);
+				return (-1);
+			}
+			label = bp++;
+			continue;
+		}
+		if (bp >= eom) {
+			__set_errno (EMSGSIZE);
+			return (-1);
+		}
+		*bp++ = (u_char)c;
+	}
+	c = (bp - label - 1);
+	if ((c & NS_CMPRSFLGS) != 0) {		/* Label too big. */
+		__set_errno (EMSGSIZE);
+		return (-1);
+	}
+	if (label >= eom) {
+		__set_errno (EMSGSIZE);
+		return (-1);
+	}
+	*label = c;
+	if (c != 0) {
+		if (bp >= eom) {
+			__set_errno (EMSGSIZE);
+			return (-1);
+		}
+		*bp++ = 0;
+	}
+	if ((bp - dst) > MAXCDNAME) {	/* src too big */
+		__set_errno (EMSGSIZE);
+		return (-1);
+	}
+	return (0);
+}
+
+/*
+ * ns_name_unpack(msg, eom, src, dst, dstsiz)
+ *	Unpack a domain name from a message, source may be compressed.
+ * return:
+ *	-1 if it fails, or consumed octets if it succeeds.
+ */
+static int
+ns_name_unpack(msg, eom, src, dst, dstsiz)
+	const u_char *msg;
+	const u_char *eom;
+	const u_char *src;
+	u_char *dst;
+	size_t dstsiz;
+{
+	const u_char *srcp, *dstlim;
+	u_char *dstp;
+#ifdef _LIBC
+	/* We don't want warnings!  */
+	int n, len, checked;
+#else
+	int n, c, len, checked;
+#endif
+
+	len = -1;
+	checked = 0;
+	dstp = dst;
+	srcp = src;
+	dstlim = dst + dstsiz;
+	if (srcp < msg || srcp >= eom) {
+		__set_errno (EMSGSIZE);
+		return (-1);
+	}
+	/* Fetch next label in domain name. */
+	while ((n = *srcp++) != 0) {
+		/* Check for indirection. */
+		switch (n & NS_CMPRSFLGS) {
+		case 0:
+			/* Limit checks. */
+			if (dstp + n + 1 >= dstlim || srcp + n >= eom) {
+				__set_errno (EMSGSIZE);
+				return (-1);
+			}
+			checked += n + 1;
+			*dstp++ = n;
+			memcpy(dstp, srcp, n);
+			dstp += n;
+			srcp += n;
+			break;
+
+		case NS_CMPRSFLGS:
+			if (srcp >= eom) {
+				__set_errno (EMSGSIZE);
+				return (-1);
+			}
+			if (len < 0)
+				len = srcp - src + 1;
+			srcp = msg + (((n & 0x3f) << 8) | (*srcp & 0xff));
+			if (srcp < msg || srcp >= eom) {  /* Out of range. */
+				__set_errno (EMSGSIZE);
+				return (-1);
+			}
+			checked += 2;
+			/*
+			 * Check for loops in the compressed name;
+			 * if we've looked at the whole message,
+			 * there must be a loop.
+			 */
+			if (checked >= eom - msg) {
+				__set_errno (EMSGSIZE);
+				return (-1);
+			}
+			break;
+
+		default:
+			__set_errno (EMSGSIZE);
+			return (-1);			/* flag error */
+		}
+	}
+	*dstp = '\0';
+	if (len < 0)
+		len = srcp - src;
+	return (len);
+}
+
+/*
+ * ns_name_pack(src, dst, dstsiz, dnptrs, lastdnptr)
+ *	Pack domain name 'domain' into 'comp_dn'.
+ * return:
+ *	Size of the compressed name, or -1.
+ * notes:
+ *	'dnptrs' is an array of pointers to previous compressed names.
+ *	dnptrs[0] is a pointer to the beginning of the message. The array
+ *	ends with NULL.
+ *	'lastdnptr' is a pointer to the end of the array pointed to
+ *	by 'dnptrs'.
+ * Side effects:
+ *	The list of pointers in dnptrs is updated for labels inserted into
+ *	the message as we compress the name.  If 'dnptr' is NULL, we don't
+ *	try to compress names. If 'lastdnptr' is NULL, we don't update the
+ *	list.
+ */
+static int
+ns_name_pack(src, dst, dstsiz, dnptrs, lastdnptr)
+	const u_char *src;
+	u_char *dst;
+	int dstsiz;
+	const u_char **dnptrs;
+	const u_char **lastdnptr;
+{
+	u_char *dstp;
+	const u_char **cpp, **lpp, *eob, *msg;
+	const u_char *srcp;
+	int n, l;
+
+	srcp = src;
+	dstp = dst;
+	eob = dstp + dstsiz;
+	lpp = cpp = NULL;
+	if (dnptrs != NULL) {
+		if ((msg = *dnptrs++) != NULL) {
+			for (cpp = dnptrs; *cpp != NULL; cpp++)
+				(void)NULL;
+			lpp = cpp;	/* end of list to search */
+		}
+	} else
+		msg = NULL;
+
+	/* make sure the domain we are about to add is legal */
+	l = 0;
+	do {
+		n = *srcp;
+		if ((n & NS_CMPRSFLGS) != 0) {
+			__set_errno (EMSGSIZE);
+			return (-1);
+		}
+		l += n + 1;
+		if (l > MAXCDNAME) {
+			__set_errno (EMSGSIZE);
+			return (-1);
+		}
+		srcp += n + 1;
+	} while (n != 0);
+
+	srcp = src;
+	do {
+		/* Look to see if we can use pointers. */
+		n = *srcp;
+		if (n != 0 && msg != NULL) {
+			l = dn_find(srcp, msg, (const u_char * const *)dnptrs,
+				    (const u_char * const *)lpp);
+			if (l >= 0) {
+				if (dstp + 1 >= eob) {
+					__set_errno (EMSGSIZE);
+					return (-1);
+				}
+				*dstp++ = (l >> 8) | NS_CMPRSFLGS;
+				*dstp++ = l % 256;
+				return (dstp - dst);
+			}
+			/* Not found, save it. */
+			if (lastdnptr != NULL && cpp < lastdnptr - 1 &&
+			    (dstp - msg) < 0x4000) {
+				*cpp++ = dstp;
+				*cpp = NULL;
+			}
+		}
+		/* copy label to buffer */
+		if (n & NS_CMPRSFLGS) {		/* Should not happen. */
+			__set_errno (EMSGSIZE);
+			return (-1);
+		}
+		if (dstp + 1 + n >= eob) {
+			__set_errno (EMSGSIZE);
+			return (-1);
+		}
+		memcpy(dstp, srcp, n + 1);
+		srcp += n + 1;
+		dstp += n + 1;
+	} while (n != 0);
+
+	if (dstp > eob) {
+		if (msg != NULL)
+			*lpp = NULL;
+		__set_errno (EMSGSIZE);
+		return (-1);
+	}
+	return (dstp - dst);
+}
+
+/*
+ * ns_name_uncompress(msg, eom, src, dst, dstsiz)
+ *	Expand compressed domain name to presentation format.
+ * return:
+ *	Number of bytes read out of `src', or -1 (with errno set).
+ * note:
+ *	Root domain returns as "." not "".
+ */
+static int
+ns_name_uncompress(msg, eom, src, dst, dstsiz)
+	const u_char *msg;
+	const u_char *eom;
+	const u_char *src;
+	char *dst;
+	size_t dstsiz;
+{
+	u_char tmp[NS_MAXCDNAME];
+	int n;
+
+	if ((n = ns_name_unpack(msg, eom, src, tmp, sizeof tmp)) == -1)
+		return (-1);
+	if (ns_name_ntop(tmp, dst, dstsiz) == -1)
+		return (-1);
+	return (n);
+}
+
+/*
+ * ns_name_compress(src, dst, dstsiz, dnptrs, lastdnptr)
+ *	Compress a domain name into wire format, using compression pointers.
+ * return:
+ *	Number of bytes consumed in `dst' or -1 (with errno set).
+ * notes:
+ *	'dnptrs' is an array of pointers to previous compressed names.
+ *	dnptrs[0] is a pointer to the beginning of the message.
+ *	The list ends with NULL.  'lastdnptr' is a pointer to the end of the
+ *	array pointed to by 'dnptrs'. Side effect is to update the list of
+ *	pointers for labels inserted into the message as we compress the name.
+ *	If 'dnptr' is NULL, we don't try to compress names. If 'lastdnptr'
+ *	is NULL, we don't update the list.
+ */
+static int
+ns_name_compress(src, dst, dstsiz, dnptrs, lastdnptr)
+	const char *src;
+	u_char *dst;
+	size_t dstsiz;
+	const u_char **dnptrs;
+	const u_char **lastdnptr;
+{
+	u_char tmp[NS_MAXCDNAME];
+
+	if (ns_name_pton(src, tmp, sizeof tmp) == -1)
+		return (-1);
+	return (ns_name_pack(tmp, dst, dstsiz, dnptrs, lastdnptr));
+}
+
+/*
+ * ns_name_skip(ptrptr, eom)
+ *	Advance *ptrptr to skip over the compressed name it points at.
+ * return:
+ *	0 on success, -1 (with errno set) on failure.
+ */
+static int
+ns_name_skip(ptrptr, eom)
+	const u_char **ptrptr;
+	const u_char *eom;
+{
+	const u_char *cp;
+	u_int n;
+
+	cp = *ptrptr;
+	while (cp < eom && (n = *cp++) != 0) {
+		/* Check for indirection. */
+		switch (n & NS_CMPRSFLGS) {
+		case 0:			/* normal case, n == len */
+			cp += n;
+			continue;
+		case NS_CMPRSFLGS:	/* indirection */
+			cp++;
+			break;
+		default:		/* illegal type */
+			__set_errno (EMSGSIZE);
+			return (-1);
+		}
+		break;
+	}
+	if (cp > eom) {
+		__set_errno (EMSGSIZE);
+		return (-1);
+	}
+	*ptrptr = cp;
+	return (0);
+}
+
+/* Private. */
+
+/*
+ * special(ch)
+ *	Thinking in noninternationalized USASCII (per the DNS spec),
+ *	is this characted special ("in need of quoting") ?
+ * return:
+ *	boolean.
+ */
+static int
+special(ch)
+	int ch;
+{
+	switch (ch) {
+	case 0x22: /* '"' */
+	case 0x2E: /* '.' */
+	case 0x3B: /* ';' */
+	case 0x5C: /* '\\' */
+	/* Special modifiers in zone files. */
+	case 0x40: /* '@' */
+	case 0x24: /* '$' */
+		return (1);
+	default:
+		return (0);
+	}
+}
+
+/*
+ * printable(ch)
+ *	Thinking in noninternationalized USASCII (per the DNS spec),
+ *	is this character visible and not a space when printed ?
+ * return:
+ *	boolean.
+ */
+static int
+printable(ch)
+	int ch;
+{
+	return (ch > 0x20 && ch < 0x7f);
+}
+
+/*
+ *	Thinking in noninternationalized USASCII (per the DNS spec),
+ *	convert this character to lower case if it's upper case.
+ */
+static int
+mklower(ch)
+	int ch;
+{
+	if (ch >= 0x41 && ch <= 0x5A)
+		return (ch + 0x20);
+	return (ch);
+}
+
+/*
+ * dn_find(domain, msg, dnptrs, lastdnptr)
+ *	Search for the counted-label name in an array of compressed names.
+ * return:
+ *	offset from msg if found, or -1.
+ * notes:
+ *	dnptrs is the pointer to the first name on the list,
+ *	not the pointer to the start of the message.
+ */
+static int
+dn_find(domain, msg, dnptrs, lastdnptr)
+	const u_char *domain;
+	const u_char *msg;
+	const u_char * const *dnptrs;
+	const u_char * const *lastdnptr;
+{
+	const u_char *dn, *cp, *sp;
+	const u_char * const *cpp;
+	u_int n;
+
+	for (cpp = dnptrs; cpp < lastdnptr; cpp++) {
+		dn = domain;
+		sp = cp = *cpp;
+		while ((n = *cp++) != 0) {
+			/*
+			 * check for indirection
+			 */
+			switch (n & NS_CMPRSFLGS) {
+			case 0:			/* normal case, n == len */
+				if (n != *dn++)
+					goto next;
+				for ((void)NULL; n > 0; n--)
+					if (mklower(*dn++) != mklower(*cp++))
+						goto next;
+				/* Is next root for both ? */
+				if (*dn == '\0' && *cp == '\0')
+					return (sp - msg);
+				if (*dn)
+					continue;
+				goto next;
+
+			case NS_CMPRSFLGS:	/* indirection */
+				cp = msg + (((n & 0x3f) << 8) | *cp);
+				break;
+
+			default:	/* illegal type */
+				__set_errno (EMSGSIZE);
+				return (-1);
+			}
+		}
+ next: ;
+	}
+	__set_errno (ENOENT);
+	return (-1);
+}
+
+/* -- From BIND 8.1.1. -- */

resolv/res_send.c

@@ -214,6 +214,8 @@ res_isourserver(inp)
 /* int
  * res_nameinquery(name, type, class, buf, eom)
  *	look for (name,type,class) in the query section of packet (buf,eom)
+ * requires:
+ *	buf + HFIXESDZ <= eom
  * returns:
  *	-1 : format error
  *	0  : not found
@@ -238,6 +240,8 @@ res_nameinquery(name, type, class, buf, eom)
 		if (n < 0)
 			return (-1);
 		cp += n;
+		if (cp + 2 * INT16SZ > eom)
+			return (-1);
 		ttype = _getshort(cp); cp += INT16SZ;
 		tclass = _getshort(cp); cp += INT16SZ;
 		if (ttype == type &&
@@ -267,6 +271,9 @@ res_queriesmatch(buf1, eom1, buf2, eom2)
 	register const u_char *cp = buf1 + HFIXEDSZ;
 	int qdcount = ntohs(((HEADER*)buf1)->qdcount);
 
+	if (buf1 + HFIXEDSZ > eom1 || buf2 + HFIXEDSZ > eom2)
+		return (-1);
+
 	if (qdcount != ntohs(((HEADER*)buf2)->qdcount))
 		return (0);
 	while (qdcount-- > 0) {
@@ -277,6 +284,8 @@ res_queriesmatch(buf1, eom1, buf2, eom2)
 		if (n < 0)
 			return (-1);
 		cp += n;
+		if (cp + 2 * INT16SZ > eom1)
+			return (-1);
 		ttype = _getshort(cp);	cp += INT16SZ;
 		tclass = _getshort(cp); cp += INT16SZ;
 		if (!res_nameinquery(tname, ttype, tclass, buf2, eom2))
@@ -302,6 +311,10 @@ res_send(buf, buflen, ans, anssiz)
 		/* errno should have been set by res_init() in this case. */
 		return (-1);
 	}
+	if (anssiz < HFIXEDSZ) {
+		__set_errno (EINVAL);
+		return (-1);
+	}
 	DprintQ((_res.options & RES_DEBUG) || (_res.pfcode & RES_PRF_QUERY),
 		(stdout, ";; res_send()\n"), buf, buflen);
 	v_circuit = (_res.options & RES_USEVC) || buflen > PACKETSZ;
@@ -446,6 +459,17 @@ read_len:
 				len = anssiz;
 			} else
 				len = resplen;
+			if (len < HFIXEDSZ) {
+				/*
+				 * Undersized message.
+				 */
+				Dprint(_res.options & RES_DEBUG,
+				       (stdout, ";; undersized: %d\n", len));
+				terrno = EMSGSIZE;
+				badns |= (1 << ns);
+				res_close();
+				goto next_ns;
+			}
 			cp = ans;
 			while (len != 0 &&
 			       (n = read(s, (char *)cp, (int)len)) > 0) {
@@ -601,12 +625,12 @@ read_len:
 			if ((long) timeout.tv_sec <= 0)
 				timeout.tv_sec = 1;
 			timeout.tv_usec = 0;
-			if (s+1 > FD_SETSIZE) {
+    wait:
-				Perror(stderr, "s+1 > FD_SETSIZE", EMFILE);
+			if (s < 0 || s >= FD_SETSIZE) {
+				Perror(stderr, "s out-of-bounds", EMFILE);
 				res_close();
 				goto next_ns;
 			}
-    wait:
 			FD_ZERO(&dsmask);
 			FD_SET(s, &dsmask);
 			n = select(s+1, &dsmask, (fd_set *)NULL,
@@ -638,6 +662,18 @@ read_len:
 				goto next_ns;
 			}
 			gotsomewhere = 1;
+			if (resplen < HFIXEDSZ) {
+				/*
+				 * Undersized message.
+				 */
+				Dprint(_res.options & RES_DEBUG,
+				       (stdout, ";; undersized: %d\n",
+					resplen));
+				terrno = EMSGSIZE;
+				badns |= (1 << ns);
+				res_close();
+				goto next_ns;
+			}
 			if (hp->id != anhp->id) {
 				/*
 				 * response from old query, ignore it.

sysdeps/arm/sysdep.h

@@ -19,7 +19,7 @@
 
 #include <sysdeps/generic/sysdep.h>
 
-#ifdef	ASSEMBLER
+#ifdef	__ASSEMBLER__
 
 /* Syntactic details of assembler.  */
 
@@ -89,4 +89,4 @@
 #define mcount		_mcount
 #endif
 
-#endif	/* ASSEMBLER */
+#endif	/* __ASSEMBLER__ */

sysdeps/i386/sysdep.h

@@ -19,7 +19,7 @@
 
 #include <sysdeps/generic/sysdep.h>
 
-#ifdef	ASSEMBLER
+#ifdef	__ASSEMBLER__
 
 /* Syntactic details of assembler.  */
 
@@ -125,4 +125,4 @@ lose: SYSCALL_PIC_SETUP							      \
 #define L(name)		name
 #endif
 
-#endif	/* ASSEMBLER */
+#endif	/* __ASSEMBLER__ */

sysdeps/m68k/sysdep.h

@@ -19,7 +19,7 @@
 
 #include <sysdeps/generic/sysdep.h>
 
-#ifdef ASSEMBLER
+#ifdef __ASSEMBLER__
 
 /* Syntactic details of assembler.  */
 
@@ -96,4 +96,4 @@
 #define JUMPTARGET(name)	name
 #endif
 
-#endif	/* ASSEMBLER */
+#endif	/* __ASSEMBLER__ */

sysdeps/mach/hurd/wait4.c

@@ -1,4 +1,4 @@
-/* Copyright (C) 1993, 1994, 1995, 1996, 1997 Free Software Foundation, Inc.
+/* Copyright (C) 1993, 94, 95, 96, 97, 98 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -23,11 +23,8 @@
 #include <hurd/port.h>
 
 pid_t
-__wait4 (pid, stat_loc, options, usage)
+__wait4 (pid_t pid, __WAIT_STATUS_DEFN stat_loc, int options,
-     pid_t pid;
+	 struct rusage *usage)
-     __WAIT_STATUS_DEFN stat_loc;
-     int options;
-     struct rusage *usage;
 {
   pid_t dead;
   error_t err;

sysdeps/mach/mips/sysdep.h

@@ -57,7 +57,7 @@ _start:\n\
 
 #include <syscall.h>
 
-#if defined (ASSEMBLER)
+#if defined (__ASSEMBLER__)
 
 #define ALIGN	2
 

sysdeps/mach/sys/reboot.h

@@ -26,8 +26,8 @@
 /*
  * HISTORY
  * $Log$
- * Revision 1.1  1993/08/03 22:25:15  roland
+ * Revision 1.2  1998/05/29 10:19:59  drepper
- * entered into RCS
+ * Use __ASSEMBLER__ test macro not ASSEMBLER.
  *
  * Revision 1.1  1993/08/03 22:25:15  roland
  * entered into RCS
@@ -43,7 +43,7 @@
  * Revision 2.6  91/06/19  11:59:44  rvb
  * 	Second byte of boothowto is flags for "startup" program.
  * 	[91/06/18            rvb]
- * 	Add ifndef ASSEMBLER so that vax_init.s can include it.
+ * 	Add ifndef __ASSEMBLER__ so that vax_init.s can include it.
  * 	[91/06/11            rvb]
  * 
  * Revision 2.5  91/05/14  17:40:11  mrt
@@ -145,9 +145,9 @@
 
 
 #ifdef	KERNEL
-#ifndef	ASSEMBLER
+#ifndef	__ASSEMBLER__
 extern int boothowto;
-#endif	ASSEMBLER
+#endif	/* __ASSEMBLER__ */
 #endif
 
 #endif	/* _SYS_REBOOT_H_ */

sysdeps/mach/sysdep.h

@@ -16,7 +16,7 @@
    write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
    Boston, MA 02111-1307, USA.  */
 
-#ifdef ASSEMBLER
+#ifdef __ASSEMBLER__
 
 /* Get the Mach definitions of ENTRY and kernel_trap.  */
 #include <mach/machine/syscall_sw.h>
@@ -45,7 +45,7 @@
    try to do anything else.  Just to be safe, deallocate the reply port so
    bogons arriving on it don't foul up future RPCs.  */
 
-#ifndef ASSEMBLER
+#ifndef __ASSEMBLER__
 #define FATAL_PREPARE_INCLUDE <mach/mig_support.h>
 #define FATAL_PREPARE __mig_dealloc_reply_port (MACH_PORT_NULL)
 #endif

sysdeps/unix/alpha/sysdep.h

@@ -19,7 +19,7 @@
 
 #include <sysdeps/unix/sysdep.h>
 
-#ifdef ASSEMBLER
+#ifdef __ASSEMBLER__
 
 #ifdef __linux__
 # include <alpha/regdef.h>

sysdeps/unix/bsd/hp/m68k/sysdep.h

@@ -20,7 +20,7 @@
 
 #include <sysdeps/unix/sysdep.h>
 
-#ifdef	ASSEMBLER
+#ifdef	__ASSEMBLER__
 
 #define	POUND	#
 
@@ -53,4 +53,4 @@
 #define	r1	d1
 #define	MOVE(x,y)	movel x , y
 
-#endif	/* ASSEMBLER */
+#endif	/* __ASSEMBLER__ */

sysdeps/unix/bsd/osf/alpha/sysdep.h

@@ -22,7 +22,7 @@
 
 #include <sysdeps/unix/alpha/sysdep.h>
 
-#ifdef ASSEMBLER
+#ifdef __ASSEMBLER__
 
 #include <machine/pal.h>		/* get PAL_callsys */
 #include <regdef.h>

sysdeps/unix/bsd/sequent/i386/sysdep.h

@@ -19,7 +19,7 @@
 
 #include <sysdeps/unix/i386/sysdep.h>
 
-#ifdef	ASSEMBLER
+#ifdef	__ASSEMBLER__
 
 /* Get the symbols for system call interrupts.  */
 #include <machine/trap.h>
@@ -79,4 +79,4 @@
 #undef	scratch
 #define scratch 	%edx	/* Call-clobbered register for random use.  */
 
-#endif	/* ASSEMBLER */
+#endif	/* __ASSEMBLER__ */

sysdeps/unix/bsd/sony/newsos/m68k/sysdep.h

@@ -18,7 +18,7 @@
 
 #include <sysdeps/unix/sysdep.h>
 
-#ifdef ASSEMBLER
+#ifdef __ASSEMBLER__
 
 #define	POUND	#
 

sysdeps/unix/bsd/sun/m68k/sysdep.h

@@ -18,7 +18,7 @@
 
 #include <sysdeps/unix/sysdep.h>
 
-#ifdef	ASSEMBLER
+#ifdef	__ASSEMBLER__
 
 #define	POUND	#
 
@@ -59,4 +59,4 @@
 #define	r1	d1
 #define	MOVE(x,y)	movel x , y
 
-#endif	/* ASSEMBLER */
+#endif	/* __ASSEMBLER__ */

sysdeps/unix/bsd/vax/sysdep.h

@@ -18,7 +18,7 @@
 
 #include <sysdeps/unix/sysdep.h>
 
-#ifdef	ASSEMBLER
+#ifdef	__ASSEMBLER__
 
 #ifdef	__STDC__
 #define	ENTRY(name)							      \
@@ -52,4 +52,4 @@
 
 #define MOVE(x,y)	movl x , y
 
-#endif	/* ASSEMBLER */
+#endif	/* __ASSEMBLER__ */

sysdeps/unix/i386/sysdep.h

@@ -19,7 +19,7 @@
 #include <sysdeps/unix/sysdep.h>
 #include <sysdeps/i386/sysdep.h>
 
-#ifdef	ASSEMBLER
+#ifdef	__ASSEMBLER__
 
 /* This is defined as a separate macro so that other sysdep.h files
    can include this one and then redefine DO_CALL.  */
@@ -33,4 +33,4 @@
 #define scratch 	%ecx	/* Call-clobbered register for random use.  */
 #define MOVE(x,y)	movl x, y
 
-#endif	/* ASSEMBLER */
+#endif	/* __ASSEMBLER__ */

sysdeps/unix/mips/sysdep.h

@@ -19,7 +19,7 @@
 
 #include <sysdeps/unix/sysdep.h>
 
-#ifdef ASSEMBLER
+#ifdef __ASSEMBLER__
 
 #include <regdef.h>
 

sysdeps/unix/sparc/sysdep.h

@@ -18,7 +18,7 @@
 
 #include <sysdeps/unix/sysdep.h>
 
-#ifdef	ASSEMBLER
+#ifdef	__ASSEMBLER__
 
 #ifdef	NO_UNDERSCORES
 /* Since C identifiers are not normally prefixed with an underscore
@@ -57,4 +57,4 @@
 #define	r1		%o1
 #define	MOVE(x,y)	mov x, y
 
-#endif	/* ASSEMBLER */
+#endif	/* __ASSEMBLER__ */

sysdeps/unix/sysv/linux/alpha/sysdep.h

@@ -17,7 +17,7 @@
    write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
    Boston, MA 02111-1307, USA.  */
 
-#ifdef ASSEMBLER
+#ifdef __ASSEMBLER__
 
 #include <asm/pal.h>
 #include <alpha/regdef.h>

sysdeps/unix/sysv/linux/arm/sysdep.h

@@ -33,7 +33,7 @@
 #define SYS_ify(syscall_name)	(__NR_##syscall_name)
 
 
-#ifdef ASSEMBLER
+#ifdef __ASSEMBLER__
 
 /* Linux uses a negative return value to indicate syscall errors,
    unlike most Unices, which use the condition codes' carry flag.
@@ -104,6 +104,6 @@
 #define UNDOARGS_4 /* nothing */
 #define UNDOARGS_5 ldr r4, [sp];
 
-#endif	/* ASSEMBLER */
+#endif	/* __ASSEMBLER__ */
 
 #endif /* linux/arm/sysdep.h */

sysdeps/unix/sysv/linux/i386/sysdep.h

@@ -34,7 +34,7 @@
 #undef L
 #define L(name)	.L##name
 
-#ifdef ASSEMBLER
+#ifdef __ASSEMBLER__
 
 /* Linux uses a negative return value to indicate syscall errors,
    unlike most Unices, which use the condition codes' carry flag.
@@ -195,6 +195,6 @@ syscall_error:								      \
 #define _DOARGS_5(n)	movl n(%esp), %edi; _DOARGS_4 (n-4)
 #define _POPARGS_5	_POPARGS_4; popl %edi
 
-#endif	/* ASSEMBLER */
+#endif	/* __ASSEMBLER__ */
 
 #endif /* linux/i386/sysdep.h */

sysdeps/unix/sysv/linux/m68k/sysdep.h

@@ -32,7 +32,7 @@
 # define SYS_ify(syscall_name)	__NR_/**/syscall_name
 #endif
 
-#ifdef ASSEMBLER
+#ifdef __ASSEMBLER__
 
 /* Linux uses a negative return value to indicate syscall errors, unlike
    most Unices, which use the condition codes' carry flag.
@@ -149,4 +149,4 @@ syscall_error:								      \
 #define	MOVE(x,y)	movel x , y
 #endif
 
-#endif	/* ASSEMBLER */
+#endif	/* __ASSEMBLER__ */

sysdeps/unix/sysv/linux/powerpc/sysdep.h

@@ -29,7 +29,7 @@
 # define SYS_ify(syscall_name)	__NR_/**/syscall_name
 #endif
 
-#ifdef ASSEMBLER
+#ifdef __ASSEMBLER__
 
 /* This seems to always be the case on PPC.  */
 #define ALIGNARG(log2) log2
@@ -141,4 +141,4 @@
 #undef L
 #define L(x) .L##x
 
-#endif	/* ASSEMBLER */
+#endif	/* __ASSEMBLER__ */

sysdeps/unix/sysv/linux/sparc/sparc32/sysdep.h

@@ -25,7 +25,7 @@
 #undef SYS_ify
 #define SYS_ify(syscall_name) __NR_##syscall_name
 
-#ifdef ASSEMBLER
+#ifdef __ASSEMBLER__
 
 #ifdef DONT_LOAD_G1
 # define LOADSYSCALL(x)
@@ -82,6 +82,6 @@
 	SYSCALL_ERROR_HANDLER;					\
 9000:;
 
-#endif	/* ASSEMBLER */
+#endif	/* __ASSEMBLER__ */
 
 #endif /* linux/sparc/sysdep.h */

sysdeps/unix/sysv/linux/sparc/sparc64/sysdep.h

@@ -25,7 +25,7 @@
 #undef SYS_ify
 #define SYS_ify(syscall_name) __NR_##syscall_name
 
-#ifdef ASSEMBLER
+#ifdef __ASSEMBLER__
 
 #ifdef DONT_LOAD_G1
 # define LOADSYSCALL(x)
@@ -116,7 +116,7 @@
 #define r1              %o1
 #define MOVE(x,y)       mov x, y
 
-#endif	/* ASSEMBLER */
+#endif	/* __ASSEMBLER__ */
 
 /* This is the offset from the %sp to the backing store above the 
    register windows.  So if you poke stack memory directly you add this.  */

sysdeps/unix/sysv/sysv4/solaris2/sparc/sysdep.h

@@ -24,7 +24,7 @@
 
 #include <sysdeps/unix/sysdep.h>
 
-#ifdef	ASSEMBLER
+#ifdef	__ASSEMBLER__
 
 /* As of gcc-2.6.0, it complains about pound signs in front of things
    that aren't arguments to the macro.  So we use this to pull it off
@@ -51,4 +51,4 @@
 #define	r1		%o1
 #define	MOVE(x,y)	mov x, y
 
-#endif	/* ASSEMBLER */
+#endif	/* __ASSEMBLER__ */