mindspore2022/third_party/patch/c-ares/CVE-2021-3672.patch

diff -Npur c-ares-1.15.0/ares_expand_name.c c-ares-1.15.0-new/ares_expand_name.c
--- c-ares-1.15.0/ares_expand_name.c	2017-07-03 17:04:19.000000000 +0800
+++ c-ares-1.15.0-new/ares_expand_name.c	2021-08-21 22:48:24.650973166 +0800
@@ -38,6 +38,26 @@
 static int name_length(const unsigned char *encoded, const unsigned char *abuf,
                        int alen);
 
+/* Reserved characters for names that need to be escaped */
+static int is_reservedch(int ch)
+{
+  switch (ch) {
+    case '"':
+    case '.':
+    case ';':
+    case '\\':
+    case '(':
+    case ')':
+    case '@':
+    case '$':
+      return 1;
+    default:
+      break;
+  }
+
+  return 0;
+}
+
 /* Expand an RFC1035-encoded domain name given by encoded.  The
  * containing message is given by abuf and alen.  The result given by
  * *s, which is set to a NUL-terminated allocated buffer.  *enclen is
@@ -113,18 +133,37 @@ int ares_expand_name(const unsigned char
         }
       else
         {
-          len = *p;
+          int name_len = *p;
+          len = name_len;
           p++;
+
           while (len--)
             {
-              if (*p == '.' || *p == '\\')
-                *q++ = '\\';
-              *q++ = *p;
+              /* Output as \DDD for consistency with RFC1035 5.1, except
+               * for the special case of a root name response  */
+              if (!isprint(*p) && !(name_len == 1 && *p == 0))
+                {
+
+                  *q++ = '\\';
+                  *q++ = '0' + *p / 100;
+                  *q++ = '0' + (*p % 100) / 10;
+                  *q++ = '0' + (*p % 10);
+                }
+              else if (is_reservedch(*p))
+                {
+                  *q++ = '\\';
+                  *q++ = *p;
+                }
+              else
+                {
+                  *q++ = *p;
+                }
               p++;
             }
           *q++ = '.';
         }
-    }
+     }
+
   if (!indir)
     *enclen = aresx_uztosl(p + 1U - encoded);
 
@@ -171,15 +210,29 @@ static int name_length(const unsigned ch
         }
       else if (top == 0x00)
         {
-          offset = *encoded;
+          int name_len = *encoded;
+          offset = name_len;
           if (encoded + offset + 1 >= abuf + alen)
             return -1;
           encoded++;
+
           while (offset--)
             {
-              n += (*encoded == '.' || *encoded == '\\') ? 2 : 1;
+              if (!isprint(*encoded) && !(name_len == 1 && *encoded == 0))
+                {
+                  n += 4;
+                }
+              else if (is_reservedch(*encoded))
+                {
+                  n += 2;
+                }
+              else
+                {
+                  n += 1;
+                }
               encoded++;
             }
+
           n++;
         }
       else