Replace configuration file parsers with memory-safe parser (#725)

Rewrite configuration parsers using new memory safe parsing functions.
After CVE-2024-25629 its obvious that we need to prioritize again on
getting all the hand written parsers with direct pointer manipulation
replaced. They're just not safe and hard to audit. It was yet another
example of 20+yr old code having a memory safety issue just now coming
to light.

Though these parsers are definitely less efficient, they're written with
memory safety in mind, and any performance difference is going to be
meaningless for something that only happens once a while.

Fix By: Brad House (@bradh352)

Author: bradh352

src/lib/Makefile.inc

@@ -13,7 +13,6 @@ CSOURCES = ares__addrinfo2hostent.c	\
   ares__iface_ips.c			\
   ares__llist.c				\
   ares__parse_into_addrinfo.c		\
-  ares__read_line.c			\
   ares__slist.c				\
   ares__socket.c			\
   ares__sortaddrinfo.c			\

src/lib/ares__buf.c

@@ -45,47 +45,6 @@ struct ares__buf {
                                        *   SIZE_MAX if not set. */
 };
 
-ares_bool_t ares__isprint(int ch)
-{
-  if (ch >= 0x20 && ch <= 0x7E) {
-    return ARES_TRUE;
-  }
-  return ARES_FALSE;
-}
-
-/* Character set allowed by hostnames.  This is to include the normal
- * domain name character set plus:
- *  - underscores which are used in SRV records.
- *  - Forward slashes such as are used for classless in-addr.arpa
- *    delegation (CNAMEs)
- *  - Asterisks may be used for wildcard domains in CNAMEs as seen in the
- *    real world.
- * While RFC 2181 section 11 does state not to do validation,
- * that applies to servers, not clients.  Vulnerabilities have been
- * reported when this validation is not performed.  Security is more
- * important than edge-case compatibility (which is probably invalid
- * anyhow). */
-ares_bool_t ares__is_hostnamech(int ch)
-{
-  /* [A-Za-z0-9-*._/]
-   * Don't use isalnum() as it is locale-specific
-   */
-  if (ch >= 'A' && ch <= 'Z') {
-    return ARES_TRUE;
-  }
-  if (ch >= 'a' && ch <= 'z') {
-    return ARES_TRUE;
-  }
-  if (ch >= '0' && ch <= '9') {
-    return ARES_TRUE;
-  }
-  if (ch == '-' || ch == '.' || ch == '_' || ch == '/' || ch == '*') {
-    return ARES_TRUE;
-  }
-
-  return ARES_FALSE;
-}
-
 ares__buf_t *ares__buf_create(void)
 {
   ares__buf_t *buf = ares_malloc_zero(sizeof(*buf));
@@ -630,6 +589,24 @@ ares_status_t ares__buf_fetch_bytes_into_buf(ares__buf_t *buf,
   return ares__buf_consume(buf, len);
 }
 
+static ares_bool_t ares__is_whitespace(unsigned char c,
+                                       ares_bool_t   include_linefeed)
+{
+  switch (c) {
+    case '\r':
+    case '\t':
+    case ' ':
+    case '\v':
+    case '\f':
+      return ARES_TRUE;
+    case '\n':
+      return include_linefeed;
+    default:
+      break;
+  }
+  return ARES_FALSE;
+}
+
 size_t ares__buf_consume_whitespace(ares__buf_t *buf,
                                     ares_bool_t  include_linefeed)
 {
@@ -642,24 +619,11 @@ size_t ares__buf_consume_whitespace(ares__buf_t *buf,
   }
 
   for (i = 0; i < remaining_len; i++) {
-    switch (ptr[i]) {
-      case '\r':
-      case '\t':
-      case ' ':
-      case '\v':
-      case '\f':
-        break;
-      case '\n':
-        if (!include_linefeed) {
-          goto done;
-        }
-        break;
-      default:
-        goto done;
+    if (!ares__is_whitespace(ptr[i], include_linefeed)) {
+      break;
     }
   }
 
-done:
   if (i > 0) {
     ares__buf_consume(buf, i);
   }
@@ -677,20 +641,11 @@ size_t ares__buf_consume_nonwhitespace(ares__buf_t *buf)
   }
 
   for (i = 0; i < remaining_len; i++) {
-    switch (ptr[i]) {
-      case '\r':
-      case '\t':
-      case ' ':
-      case '\v':
-      case '\f':
-      case '\n':
-        goto done;
-      default:
-        break;
+    if (ares__is_whitespace(ptr[i], ARES_TRUE)) {
+      break;
     }
   }
 
-done:
   if (i > 0) {
     ares__buf_consume(buf, i);
   }
@@ -826,7 +781,7 @@ static ares_bool_t ares__buf_split_isduplicate(ares__llist_t       *list,
 
 ares_status_t ares__buf_split(ares__buf_t *buf, const unsigned char *delims,
                               size_t delims_len, ares__buf_split_t flags,
-                              ares__llist_t **list)
+                              size_t max_sections, ares__llist_t **list)
 {
   ares_status_t status = ARES_SUCCESS;
   ares_bool_t   first  = ARES_TRUE;
@@ -842,20 +797,57 @@ ares_status_t ares__buf_split(ares__buf_t *buf, const unsigned char *delims,
   }
 
   while (ares__buf_len(buf)) {
-    size_t len;
+    size_t               len = 0;
+    const unsigned char *ptr;
+
+    if (first) {
+      /* No delimiter yet, just tag the start */
+      ares__buf_tag(buf);
+    } else {
+      if (flags & ARES_BUF_SPLIT_DONT_CONSUME_DELIMS) {
+        /* tag then eat delimiter so its first byte in buffer */
+        ares__buf_tag(buf);
+        ares__buf_consume(buf, 1);
+      } else {
+        /* throw away delimiter */
+        ares__buf_consume(buf, 1);
+        ares__buf_tag(buf);
+      }
+    }
+
+    if (max_sections && ares__llist_len(*list) >= max_sections - 1) {
+      ares__buf_consume(buf, ares__buf_len(buf));
+    } else {
+      ares__buf_consume_until_charset(buf, delims, delims_len, ARES_FALSE);
+    }
 
-    ares__buf_tag(buf);
+    ptr = ares__buf_tag_fetch(buf, &len);
 
-    len = ares__buf_consume_until_charset(buf, delims, delims_len, ARES_FALSE);
+    /* Shouldn't be possible */
+    if (ptr == NULL) {
+      status = ARES_EFORMERR;
+      goto done;
+    }
+
+    if (flags & ARES_BUF_SPLIT_LTRIM) {
+      size_t i;
+      for (i = 0; i < len; i++) {
+        if (!ares__is_whitespace(ptr[i], ARES_TRUE)) {
+          break;
+        }
+      }
+      ptr += i;
+      len -= i;
+    }
 
-    /* Don't treat a delimiter as part of the length */
-    if (!first && len && flags & ARES_BUF_SPLIT_DONT_CONSUME_DELIMS) {
-      len--;
+    if (flags & ARES_BUF_SPLIT_RTRIM) {
+      while (len && ares__is_whitespace(ptr[len - 1], ARES_TRUE)) {
+        len--;
+      }
     }
 
     if (len != 0 || flags & ARES_BUF_SPLIT_ALLOW_BLANK) {
-      const unsigned char *ptr = ares__buf_tag_fetch(buf, &len);
-      ares__buf_t         *data;
+      ares__buf_t *data;
 
       if (!(flags & ARES_BUF_SPLIT_NO_DUPLICATES) ||
           !ares__buf_split_isduplicate(*list, ptr, len, flags)) {
@@ -880,12 +872,6 @@ ares_status_t ares__buf_split(ares__buf_t *buf, const unsigned char *delims,
       }
     }
 
-    if (!(flags & ARES_BUF_SPLIT_DONT_CONSUME_DELIMS) &&
-        ares__buf_len(buf) != 0) {
-      /* Consume delimiter */
-      ares__buf_consume(buf, 1);
-    }
-
     first = ARES_FALSE;
   }
 
@@ -1150,3 +1136,80 @@ ares_status_t ares__buf_hexdump(ares__buf_t *buf, const unsigned char *data,
 
   return ARES_SUCCESS;
 }
+
+ares_status_t ares__buf_load_file(const char *filename, ares__buf_t *buf)
+{
+  FILE          *fp        = NULL;
+  unsigned char *ptr       = NULL;
+  size_t         len       = 0;
+  size_t         ptr_len   = 0;
+  long           ftell_len = 0;
+  ares_status_t  status;
+
+  if (filename == NULL || buf == NULL) {
+    return ARES_EFORMERR;
+  }
+
+  fp = fopen(filename, "rb");
+  if (fp == NULL) {
+    int error = ERRNO;
+    switch (error) {
+      case ENOENT:
+      case ESRCH:
+        status = ARES_ENOTFOUND;
+        goto done;
+      default:
+        DEBUGF(fprintf(stderr, "fopen() failed with error: %d %s\n", error,
+                       strerror(error)));
+        DEBUGF(fprintf(stderr, "Error opening file: %s\n", filename));
+        status = ARES_EFILE;
+        goto done;
+    }
+  }
+
+  /* Get length portably, fstat() is POSIX, not C */
+  if (fseek(fp, 0, SEEK_END) != 0) {
+    status = ARES_EFILE;
+    goto done;
+  }
+
+  ftell_len = ftell(fp);
+  if (ftell_len < 0) {
+    status = ARES_EFILE;
+    goto done;
+  }
+  len = (size_t)ftell_len;
+
+  if (fseek(fp, 0, SEEK_SET) != 0) {
+    status = ARES_EFILE;
+    goto done;
+  }
+
+  if (len == 0) {
+    status = ARES_SUCCESS;
+    goto done;
+  }
+
+  /* Read entire data into buffer */
+  ptr_len = len;
+  ptr     = ares__buf_append_start(buf, &ptr_len);
+  if (ptr == NULL) {
+    status = ARES_ENOMEM;
+    goto done;
+  }
+
+  ptr_len = fread(ptr, 1, len, fp);
+  if (ptr_len != len) {
+    status = ARES_EFILE;
+    goto done;
+  }
+
+  ares__buf_append_finish(buf, len);
+  status = ARES_SUCCESS;
+
+done:
+  if (fp != NULL) {
+    fclose(fp);
+  }
+  return status;
+}

src/lib/ares__buf.h

@@ -373,7 +373,8 @@ size_t        ares__buf_consume_whitespace(ares__buf_t *buf,
 size_t        ares__buf_consume_nonwhitespace(ares__buf_t *buf);
 
 
-/*! Consume until a character in the character set provided is reached
+/*! Consume until a character in the character set provided is reached.  Does
+ *  not include the character from the charset at the end.
  *
  *  \param[in] buf                Initialized buffer object
  *  \param[in] charset            character set
@@ -414,7 +415,9 @@ typedef enum {
   /*! No flags */
   ARES_BUF_SPLIT_NONE = 0,
   /*! The delimiter will be the first character in the buffer, except the
-   *  first buffer since the start doesn't have a delimiter
+   *  first buffer since the start doesn't have a delimiter.  This option is
+   *  incompatible with ARES_BUF_SPLIT_LTRIM since the delimiter is always
+   *  the first character.
    */
   ARES_BUF_SPLIT_DONT_CONSUME_DELIMS = 1 << 0,
   /*! Allow blank sections, by default blank sections are not emitted.  If using
@@ -424,7 +427,13 @@ typedef enum {
   /*! Remove duplicate entries */
   ARES_BUF_SPLIT_NO_DUPLICATES = 1 << 2,
   /*! Perform case-insensitive matching when comparing values */
-  ARES_BUF_SPLIT_CASE_INSENSITIVE = 1 << 3
+  ARES_BUF_SPLIT_CASE_INSENSITIVE = 1 << 3,
+  /*! Trim leading whitespace from buffer */
+  ARES_BUF_SPLIT_LTRIM = 1 << 4,
+  /*! Trim trailing whitespace from buffer */
+  ARES_BUF_SPLIT_RTRIM = 1 << 5,
+  /*! Trim leading and trailing whitespace from buffer */
+  ARES_BUF_SPLIT_TRIM = (ARES_BUF_SPLIT_LTRIM | ARES_BUF_SPLIT_RTRIM)
 } ares__buf_split_t;
 
 /*! Split the provided buffer into multiple sub-buffers stored in the variable
@@ -435,6 +444,12 @@ typedef enum {
  *  \param[in]  delims            Possible delimiters
  *  \param[in]  delims_len        Length of possible delimiters
  *  \param[in]  flags             One more more flags
+ *  \param[in]  max_sections      Maximum number of sections.  Use 0 for
+ *                                unlimited. Useful for splitting key/value
+ *                                pairs where the delimiter may be a valid
+ *                                character in the value.  A value of 1 would
+ *                                have little usefulness and would effectively
+ *                                ignore the delimiter itself.
  *  \param[out] list              Result. Depending on flags, this may be a
  *                                valid list with no elements.  Use
  *                                ares__llist_destroy() to free the memory which
@@ -444,7 +459,7 @@ typedef enum {
  */
 ares_status_t ares__buf_split(ares__buf_t *buf, const unsigned char *delims,
                               size_t delims_len, ares__buf_split_t flags,
-                              ares__llist_t **list);
+                              size_t max_sections, ares__llist_t **list);
 
 
 /*! Check the unprocessed buffer to see if it begins with the sequence of
@@ -567,6 +582,18 @@ ares_status_t ares__buf_parse_dns_str(ares__buf_t *buf, size_t remaining_len,
 ares_status_t ares__buf_parse_dns_binstr(ares__buf_t *buf, size_t remaining_len,
                                          unsigned char **bin, size_t *bin_len,
                                          ares_bool_t allow_multiple);
+
+/*! Load data from specified file path into provided buffer.  The entire file
+ *  is loaded into memory.
+ *
+ *  \param[in]     filename complete path to file
+ *  \param[in,out] buf      Initialized (non-const) buffer object to load data
+ *                          into
+ *  \return ARES_ENOTFOUND if file not found, ARES_EFILE if issues reading
+ *          file, ARES_ENOMEM if out of memory, ARES_SUCCESS on success.
+ */
+ares_status_t ares__buf_load_file(const char *filename, ares__buf_t *buf);
+
 /*! @} */
 
 #endif /* __ARES__BUF_H */