1 files changed, 33 insertions, 21 deletions

diff --git a/src/gns/gnunet-service-gns.c b/src/gns/gnunet-service-gns.c
index c376ddfcc..71e744733 100644
--- a/src/gns/gnunet-service-gns.c
+++ b/src/gns/gnunet-service-gns.c
@@ -2,20 +2,18 @@
      This file is part of GNUnet.
      Copyright (C) 2011-2018 GNUnet e.V.
 
-     GNUnet is free software; you can redistribute it and/or modify
-     it under the terms of the GNU General Public License as published
-     by the Free Software Foundation; either version 3, or (at your
-     option) any later version.
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
 
      GNUnet is distributed in the hope that it will be useful, but
      WITHOUT ANY WARRANTY; without even the implied warranty of
      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     General Public License for more details.
-
-     You should have received a copy of the GNU General Public License
-     along with GNUnet; see the file COPYING.  If not, write to the
-     Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-     Boston, MA 02110-1301, USA.
+     Affero General Public License for more details.
+    
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 /**
  * @file gns/gnunet-service-gns.c
@@ -296,7 +294,6 @@ client_disconnect_cb (void *cls,
                                  clh);
     GNUNET_free (clh);
   }
-
   GNUNET_free (gc);
 }
 
@@ -335,31 +332,47 @@ client_connect_cb (void *cls,
  * @param rd the record data
  */
 static void
-send_lookup_response (void* cls,
+send_lookup_response (void *cls,
                       uint32_t rd_count,
                       const struct GNUNET_GNSRECORD_Data *rd)
 {
   struct ClientLookupHandle *clh = cls;
+  struct GnsClient *gc = clh->gc;
   struct GNUNET_MQ_Envelope *env;
   struct LookupResultMessage *rmsg;
-  size_t len;
+  ssize_t len;
 
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Sending LOOKUP_RESULT message with %u results\n",
               (unsigned int) rd_count);
-
-  len = GNUNET_GNSRECORD_records_get_size (rd_count, rd);
+  len = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                           rd);
+  if (len < 0)
+  {
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (gc->client);
+    return;
+  }
+  if (len > UINT16_MAX - sizeof (*rmsg))
+  {
+    GNUNET_break (0);
+    GNUNET_SERVICE_client_drop (gc->client);
+    return;
+  }
   env = GNUNET_MQ_msg_extra (rmsg,
                              len,
                              GNUNET_MESSAGE_TYPE_GNS_LOOKUP_RESULT);
   rmsg->id = clh->request_id;
   rmsg->rd_count = htonl (rd_count);
-  GNUNET_GNSRECORD_records_serialize (rd_count, rd, len,
-                                      (char*) &rmsg[1]);
-  GNUNET_MQ_send (GNUNET_SERVICE_client_get_mq(clh->gc->client),
+  GNUNET_assert (len ==
+                 GNUNET_GNSRECORD_records_serialize (rd_count,
+                                                     rd,
+                                                     len,
+                                                     (char*) &rmsg[1]));
+  GNUNET_MQ_send (GNUNET_SERVICE_client_get_mq (gc->client),
                   env);
-  GNUNET_CONTAINER_DLL_remove (clh->gc->clh_head,
-                               clh->gc->clh_tail,
+  GNUNET_CONTAINER_DLL_remove (gc->clh_head,
+                               gc->clh_tail,
                                clh);
   GNUNET_free (clh);
   GNUNET_STATISTICS_update (statistics,
@@ -428,7 +441,6 @@ handle_lookup (void *cls,
   GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
               "Received LOOKUP `%s' message\n",
               name);
-
   clh = GNUNET_new (struct ClientLookupHandle);
   GNUNET_CONTAINER_DLL_insert (gc->clh_head,
                                gc->clh_tail,