Numeric truncation when parsing TYPEXX and CLASSXX representation

daemon/remote.c

@@ -1581,6 +1581,9 @@ do_flush_type(RES* ssl, struct worker* worker, char* arg)
 	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
 		return;
 	t = sldns_get_rr_type_by_name(arg2);
+	if(t == 0 && strcmp(arg2, "TYPE0") != 0) {
+		return 0;
+	}
 	do_cache_remove(worker, nm, nmlen, t, LDNS_RR_CLASS_IN);
 
 	free(nm);

sldns/rrdef.c

@@ -702,7 +702,11 @@ sldns_get_rr_type_by_name(const char *name)
 
 	/* TYPEXX representation */
 	if (strlen(name) > 4 && strncasecmp(name, "TYPE", 4) == 0) {
-		return atoi(name + 4);
+		unsigned int a = atoi(name + 4);
+		if (a > LDNS_RR_TYPE_LAST) {
+			return (enum sldns_enum_rr_type)0;
+		}
+		return a;
 	}
 
 	/* Normal types */
@@ -740,7 +744,11 @@ sldns_get_rr_class_by_name(const char *name)
 
 	/* CLASSXX representation */
 	if (strlen(name) > 5 && strncasecmp(name, "CLASS", 5) == 0) {
-		return atoi(name + 5);
+		unsigned int a = atoi(name + 5);
+		if (a > LDNS_RR_TYPE_LAST) {
+			return (enum sldns_enum_rr_class)0;
+		}
+		return a;
 	}
 
 	/* Normal types */

testcode/dohclient.c

@@ -229,6 +229,10 @@ make_query(char* qname, char* qtype, char* qclass)
 
 	qinfo.qtype = sldns_get_rr_type_by_name(qtype);
 	qinfo.qclass = sldns_get_rr_class_by_name(qclass);
+	if((qinfo.qtype == 0 && strcmp(qtype, "TYPE0") != 0) ||
+	   (qinfo.qclass == 0 && strcmp(qclass, "CLASS0") != 0)) {
+		return 0;
+	}
 	qinfo.local_alias = NULL;
 
 	qinfo_query_encode(buf, &qinfo); /* flips buffer */

testcode/perf.c

@@ -458,9 +458,17 @@ qlist_parse_line(sldns_buffer* buf, char* p)
 	if(strcmp(tp, "IN") == 0 || strcmp(tp, "CH") == 0) {
 		qinfo.qtype = sldns_get_rr_type_by_name(cl);
 		qinfo.qclass = sldns_get_rr_class_by_name(tp);
+		if((qinfo.qtype == 0 && strcmp(cl, "TYPE0") != 0) ||
+		   (qinfo.qclass == 0 && strcmp(tp, "CLASS0") != 0)) {
+			return 0;
+		}
 	} else {
 		qinfo.qtype = sldns_get_rr_type_by_name(tp);
 		qinfo.qclass = sldns_get_rr_class_by_name(cl);
+		if((qinfo.qtype == 0 && strcmp(tp, "TYPE0") != 0) ||
+		   (qinfo.qclass == 0 && strcmp(cl, "CLASS0") != 0)) {
+			return 0;
+		}
 	}
 	if(fl[0] == '+') rec = 1;
 	else if(fl[0] == '-') rec = 0;

testcode/streamtcp.c

@@ -133,6 +133,10 @@ write_q(int fd, int udp, SSL* ssl, sldns_buffer* buf, uint16_t id,
 	/* qtype and qclass */
 	qinfo.qtype = sldns_get_rr_type_by_name(strtype);
 	qinfo.qclass = sldns_get_rr_class_by_name(strclass);
+	if((qinfo.qtype == 0 && strcmp(strtype, "TYPE0") != 0) ||
+	   (qinfo.qclass == 0 && strcmp(strclass, "CLASS0") != 0)) {
+		return 0;
+	}
 
 	/* clear local alias */
 	qinfo.local_alias = NULL;