../src/resolve/resolved-dns-packet.c

Bug Summary

File:	build-scan/../src/resolve/resolved-dns-packet.c
Warning:	line 580, column 9 Potential leak of memory pointed to by 's'
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name resolved-dns-packet.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -relaxed-aliasing -menable-no-infs -menable-no-nans -menable-unsafe-fp-math -fno-signed-zeros -mreassociate -freciprocal-math -fdenormal-fp-math=preserve-sign,preserve-sign -ffp-contract=fast -fno-rounding-math -ffast-math -ffinite-math-only -mconstructor-aliases -munwind-tables -target-cpu x86-64 -tune-cpu generic -fno-split-dwarf-inlining -debugger-tuning=gdb -resource-dir /usr/lib64/clang/12.0.0 -include config.h -I src/resolve/libsystemd-resolve-core.a.p -I src/resolve -I ../src/resolve -I src/basic -I ../src/basic -I src/shared -I ../src/shared -I src/systemd -I ../src/systemd -I src/journal -I ../src/journal -I src/journal-remote -I ../src/journal-remote -I src/nspawn -I ../src/nspawn -I src/timesync -I ../src/timesync -I ../src/time-wait-sync -I src/login -I ../src/login -I src/udev -I ../src/udev -I src/libudev -I ../src/libudev -I src/core -I ../src/core -I ../src/libsystemd/sd-bus -I ../src/libsystemd/sd-device -I ../src/libsystemd/sd-hwdb -I ../src/libsystemd/sd-id128 -I ../src/libsystemd/sd-netlink -I ../src/libsystemd/sd-network -I src/libsystemd-network -I ../src/libsystemd-network -I . -I .. -D _FILE_OFFSET_BITS=64 -internal-isystem /usr/local/include -internal-isystem /usr/lib64/clang/12.0.0/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -Wwrite-strings -Wno-unused-parameter -Wno-missing-field-initializers -Wno-unused-result -Wno-format-signedness -Wno-error=nonnull -std=gnu99 -fconst-strings -fdebug-compilation-dir /home/mrc0mmand/repos/@redhat-plumbers/systemd-rhel8/build-scan -ferror-limit 19 -fvisibility hidden -stack-protector 2 -fgnuc-version=4.2.1 -fcolor-diagnostics -analyzer-output=html -faddrsig -o /tmp/scan-build-2021-07-16-221226-1465241-1 -x c ../src/resolve/resolved-dns-packet.c
1/* SPDX-License-Identifier: LGPL-2.1+ */
2/***
***/

5#if HAVE_GCRYPT1
6#include <gcrypt.h>
7#endif

9#include "alloc-util.h"
10#include "dns-domain.h"
11#include "resolved-dns-packet.h"
12#include "string-table.h"
13#include "strv.h"
14#include "unaligned.h"
15#include "utf8.h"
16#include "util.h"

18#define EDNS0_OPT_DO(1<<15) (1<<15)

20assert_cc(DNS_PACKET_SIZE_START > DNS_PACKET_HEADER_SIZE)GCC diagnostic push
; GCC diagnostic ignored "-Wdeclaration-after-statement"

; struct _assert_struct_16 { char x[(512u > sizeof(DnsPacketHeader
)) ? 0 : -1]; }; GCC diagnostic pop

22typedef struct DnsPacketRewinder {
      DnsPacket *packet;
      size_t saved_rindex;
25} DnsPacketRewinder;

27static void rewind_dns_packet(DnsPacketRewinder *rewinder) {
      if (rewinder->packet)
              dns_packet_rewind(rewinder->packet, rewinder->saved_rindex);
30}

32#define INIT_REWINDER(rewinder, p)do { rewinder.packet = p; rewinder.saved_rindex = p->rindex
; } while (0) do { rewinder.packet = p; rewinder.saved_rindex = p->rindex; } while (0)
33#define CANCEL_REWINDER(rewinder)do { rewinder.packet = ((void*)0); } while (0) do { rewinder.packet = NULL((void*)0); } while (0)

35int dns_packet_new(
              DnsPacket **ret,
              DnsProtocol protocol,
              size_t min_alloc_dsize,
              size_t max_size) {

      DnsPacket *p;
      size_t a;

      assert(ret)do { if ((__builtin_expect(!!(!(ret)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("ret"), "../src/resolve/resolved-dns-packet.c"
, 44, __PRETTY_FUNCTION__); } while (0);
      assert(max_size >= DNS_PACKET_HEADER_SIZE)do { if ((__builtin_expect(!!(!(max_size >= sizeof(DnsPacketHeader
))),0))) log_assert_failed_realm(LOG_REALM_SYSTEMD, ("max_size >= DNS_PACKET_HEADER_SIZE"
), "../src/resolve/resolved-dns-packet.c", 45, __PRETTY_FUNCTION__
); } while (0);

      if (max_size > DNS_PACKET_SIZE_MAX0xFFFFu)
              max_size = DNS_PACKET_SIZE_MAX0xFFFFu;

      /* The caller may not check what is going to be truly allocated, so do not allow to
       * allocate a DNS packet bigger than DNS_PACKET_SIZE_MAX.
       */
      if (min_alloc_dsize > DNS_PACKET_SIZE_MAX0xFFFFu) {
              log_error("Requested packet data size too big: %zu", min_alloc_dsize)({ int _level = (((3))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-packet.c", 54, __func__, "Requested packet data size too big: %zu"
, min_alloc_dsize) : -abs(_e); });
              return -EFBIG27;
      }

      /* When dns_packet_new() is called with min_alloc_dsize == 0, allocate more than the
       * absolute minimum (which is the dns packet header size), to avoid
       * resizing immediately again after appending the first data to the packet.
       */
      if (min_alloc_dsize < DNS_PACKET_HEADER_SIZEsizeof(DnsPacketHeader))
              a = DNS_PACKET_SIZE_START512u;
      else
              a = min_alloc_dsize;

      /* round up to next page size */
      a = PAGE_ALIGN(ALIGN(sizeof(DnsPacket)) + a)ALIGN_TO(((((sizeof(DnsPacket)) + 7) & ~7) + a), page_size
()) - ALIGN(sizeof(DnsPacket))(((sizeof(DnsPacket)) + 7) & ~7);

      /* make sure we never allocate more than useful */
      if (a > max_size)
              a = max_size;

      p = malloc0(ALIGN(sizeof(DnsPacket)) + a)(calloc(1, ((((sizeof(DnsPacket)) + 7) & ~7) + a)));
      if (!p)
              return -ENOMEM12;

      p->size = p->rindex = DNS_PACKET_HEADER_SIZEsizeof(DnsPacketHeader);
      p->allocated = a;
      p->max_size = max_size;
      p->protocol = protocol;
      p->opt_start = p->opt_size = (size_t) -1;
      p->n_ref = 1;

      *ret = p;

      return 0;
88}

90void dns_packet_set_flags(DnsPacket *p, bool_Bool dnssec_checking_disabled, bool_Bool truncated) {

      DnsPacketHeader *h;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 94, __PRETTY_FUNCTION__); } while (0);

      h = DNS_PACKET_HEADER(p)((DnsPacketHeader*) DNS_PACKET_DATA(p));

      switch(p->protocol) {
      case DNS_PROTOCOL_LLMNR:
              assert(!truncated)do { if ((__builtin_expect(!!(!(!truncated)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("!truncated"), "../src/resolve/resolved-dns-packet.c"
, 100, __PRETTY_FUNCTION__); } while (0);

              h->flags = htobe16(DNS_PACKET_MAKE_FLAGS(0 /* qr */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(0) <<
 4) | ((uint16_t) ((0) & 15)))
                                                       0 /* opcode */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(0) <<
 4) | ((uint16_t) ((0) & 15)))
                                                       0 /* c */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(0) <<
 4) | ((uint16_t) ((0) & 15)))
                                                       0 /* tc */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(0) <<
 4) | ((uint16_t) ((0) & 15)))
                                                       0 /* t */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(0) <<
 4) | ((uint16_t) ((0) & 15)))
                                                       0 /* ra */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(0) <<
 4) | ((uint16_t) ((0) & 15)))
                                                       0 /* ad */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(0) <<
 4) | ((uint16_t) ((0) & 15)))
                                                       0 /* cd */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(0) <<
 4) | ((uint16_t) ((0) & 15)))
                                                       0 /* rcode */)(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(0) <<
 4) | ((uint16_t) ((0) & 15))));
              break;

      case DNS_PROTOCOL_MDNS:
              h->flags = htobe16(DNS_PACKET_MAKE_FLAGS(0         /* qr */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(truncated
) << 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !
!(0) << 7) | ((uint16_t) !!(0) << 5) | ((uint16_t
) !!(0) << 4) | ((uint16_t) ((0) & 15)))
                                                       0         /* opcode */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(truncated
) << 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !
!(0) << 7) | ((uint16_t) !!(0) << 5) | ((uint16_t
) !!(0) << 4) | ((uint16_t) ((0) & 15)))
                                                       0         /* aa */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(truncated
) << 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !
!(0) << 7) | ((uint16_t) !!(0) << 5) | ((uint16_t
) !!(0) << 4) | ((uint16_t) ((0) & 15)))
                                                       truncated /* tc */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(truncated
) << 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !
!(0) << 7) | ((uint16_t) !!(0) << 5) | ((uint16_t
) !!(0) << 4) | ((uint16_t) ((0) & 15)))
                                                       0         /* rd (ask for recursion) */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(truncated
) << 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !
!(0) << 7) | ((uint16_t) !!(0) << 5) | ((uint16_t
) !!(0) << 4) | ((uint16_t) ((0) & 15)))
                                                       0         /* ra */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(truncated
) << 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !
!(0) << 7) | ((uint16_t) !!(0) << 5) | ((uint16_t
) !!(0) << 4) | ((uint16_t) ((0) & 15)))
                                                       0         /* ad */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(truncated
) << 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !
!(0) << 7) | ((uint16_t) !!(0) << 5) | ((uint16_t
) !!(0) << 4) | ((uint16_t) ((0) & 15)))
                                                       0         /* cd */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(truncated
) << 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !
!(0) << 7) | ((uint16_t) !!(0) << 5) | ((uint16_t
) !!(0) << 4) | ((uint16_t) ((0) & 15)))
                                                       0         /* rcode */)(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(truncated
) << 9) | ((uint16_t) !!(0) << 8) | ((uint16_t) !
!(0) << 7) | ((uint16_t) !!(0) << 5) | ((uint16_t
) !!(0) << 4) | ((uint16_t) ((0) & 15))));
              break;

      default:
              assert(!truncated)do { if ((__builtin_expect(!!(!(!truncated)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("!truncated"), "../src/resolve/resolved-dns-packet.c"
, 126, __PRETTY_FUNCTION__); } while (0);

              h->flags = htobe16(DNS_PACKET_MAKE_FLAGS(0 /* qr */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(1) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(dnssec_checking_disabled
) << 4) | ((uint16_t) ((0) & 15)))
                                                       0 /* opcode */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(1) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(dnssec_checking_disabled
) << 4) | ((uint16_t) ((0) & 15)))
                                                       0 /* aa */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(1) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(dnssec_checking_disabled
) << 4) | ((uint16_t) ((0) & 15)))
                                                       0 /* tc */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(1) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(dnssec_checking_disabled
) << 4) | ((uint16_t) ((0) & 15)))
                                                       1 /* rd (ask for recursion) */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(1) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(dnssec_checking_disabled
) << 4) | ((uint16_t) ((0) & 15)))
                                                       0 /* ra */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(1) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(dnssec_checking_disabled
) << 4) | ((uint16_t) ((0) & 15)))
                                                       0 /* ad */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(1) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(dnssec_checking_disabled
) << 4) | ((uint16_t) ((0) & 15)))
                                                       dnssec_checking_disabled /* cd */,(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(1) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(dnssec_checking_disabled
) << 4) | ((uint16_t) ((0) & 15)))
                                                       0 /* rcode */)(((uint16_t) !!(0) << 15) | ((uint16_t) ((0) & 15) <<
 11) | ((uint16_t) !!(0) << 10) | ((uint16_t) !!(0) <<
 9) | ((uint16_t) !!(1) << 8) | ((uint16_t) !!(0) <<
 7) | ((uint16_t) !!(0) << 5) | ((uint16_t) !!(dnssec_checking_disabled
) << 4) | ((uint16_t) ((0) & 15))));
      }
138}

140int dns_packet_new_query(DnsPacket **ret, DnsProtocol protocol, size_t min_alloc_dsize, bool_Bool dnssec_checking_disabled) {
      DnsPacket *p;
      int r;

      assert(ret)do { if ((__builtin_expect(!!(!(ret)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("ret"), "../src/resolve/resolved-dns-packet.c"
, 144, __PRETTY_FUNCTION__); } while (0);

      r = dns_packet_new(&p, protocol, min_alloc_dsize, DNS_PACKET_SIZE_MAX0xFFFFu);
      if (r < 0)
              return r;

      /* Always set the TC bit to 0 initially.
       * If there are multiple packets later, we'll update the bit shortly before sending.
       */
      dns_packet_set_flags(p, dnssec_checking_disabled, false0);

      *ret = p;
      return 0;
157}

159DnsPacket *dns_packet_ref(DnsPacket *p) {

      if (!p)
              return NULL((void*)0);

      assert(!p->on_stack)do { if ((__builtin_expect(!!(!(!p->on_stack)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("!p->on_stack"), "../src/resolve/resolved-dns-packet.c"
, 164, __PRETTY_FUNCTION__); } while (0);

      assert(p->n_ref > 0)do { if ((__builtin_expect(!!(!(p->n_ref > 0)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p->n_ref > 0"), "../src/resolve/resolved-dns-packet.c"
, 166, __PRETTY_FUNCTION__); } while (0);
      p->n_ref++;
      return p;
169}

171static void dns_packet_free(DnsPacket *p) {
      char *s;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 174, __PRETTY_FUNCTION__); } while (0);

      dns_question_unref(p->question);
      dns_answer_unref(p->answer);
      dns_resource_record_unref(p->opt);

      while ((s = hashmap_steal_first_key(p->names)))
              free(s);
      hashmap_free(p->names);

      free(p->_data);

      if (!p->on_stack)
              free(p);
188}

190DnsPacket *dns_packet_unref(DnsPacket *p) {
      if (!p)
              return NULL((void*)0);

      assert(p->n_ref > 0)do { if ((__builtin_expect(!!(!(p->n_ref > 0)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p->n_ref > 0"), "../src/resolve/resolved-dns-packet.c"
, 194, __PRETTY_FUNCTION__); } while (0);

      dns_packet_unref(p->more);

      if (p->n_ref == 1)
              dns_packet_free(p);
      else
              p->n_ref--;

      return NULL((void*)0);
204}

206int dns_packet_validate(DnsPacket *p) {
      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 207, __PRETTY_FUNCTION__); } while (0);

      if (p->size < DNS_PACKET_HEADER_SIZEsizeof(DnsPacketHeader))
              return -EBADMSG74;

      if (p->size > DNS_PACKET_SIZE_MAX0xFFFFu)
              return -EBADMSG74;

      return 1;
216}

218int dns_packet_validate_reply(DnsPacket *p) {
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 221, __PRETTY_FUNCTION__); } while (0);

      r = dns_packet_validate(p);
      if (r < 0)
              return r;

      if (DNS_PACKET_QR(p)((be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->flags) >>
 15) & 1) != 1)
              return 0;

      if (DNS_PACKET_OPCODE(p)((be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->flags) >>
 11) & 15) != 0)
              return -EBADMSG74;

      switch (p->protocol) {

      case DNS_PROTOCOL_LLMNR:
              /* RFC 4795, Section 2.1.1. says to discard all replies with QDCOUNT != 1 */
              if (DNS_PACKET_QDCOUNT(p)be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->qdcount) != 1)
                      return -EBADMSG74;

              break;

      case DNS_PROTOCOL_MDNS:
              /* RFC 6762, Section 18 */
              if (DNS_PACKET_RCODE(p) != 0)
                      return -EBADMSG74;

              break;

      default:
              break;
      }

      return 1;
254}

256int dns_packet_validate_query(DnsPacket *p) {
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 259, __PRETTY_FUNCTION__); } while (0);

      r = dns_packet_validate(p);
      if (r < 0)
              return r;

      if (DNS_PACKET_QR(p)((be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->flags) >>
 15) & 1) != 0)
              return 0;

      if (DNS_PACKET_OPCODE(p)((be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->flags) >>
 11) & 15) != 0)
              return -EBADMSG74;

      if (DNS_PACKET_TC(p)((be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->flags) >>
 9) & 1))
              return -EBADMSG74;

      switch (p->protocol) {

      case DNS_PROTOCOL_LLMNR:
      case DNS_PROTOCOL_DNS:
              /* RFC 4795, Section 2.1.1. says to discard all queries with QDCOUNT != 1 */
              if (DNS_PACKET_QDCOUNT(p)be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->qdcount) != 1)
                      return -EBADMSG74;

              /* RFC 4795, Section 2.1.1. says to discard all queries with ANCOUNT != 0 */
              if (DNS_PACKET_ANCOUNT(p)be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->ancount) > 0)
                      return -EBADMSG74;

              /* RFC 4795, Section 2.1.1. says to discard all queries with NSCOUNT != 0 */
              if (DNS_PACKET_NSCOUNT(p)be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->nscount) > 0)
                      return -EBADMSG74;

              break;

      case DNS_PROTOCOL_MDNS:
              /* RFC 6762, Section 18 */
              if (DNS_PACKET_AA(p)((be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->flags) >>
 10) & 1)    != 0 ||
                  DNS_PACKET_RD(p)((be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->flags) >>
 8) & 1)    != 0 ||
                  DNS_PACKET_RA(p)((be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->flags) >>
 7) & 1)    != 0 ||
                  DNS_PACKET_AD(p)((be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->flags) >>
 5) & 1)    != 0 ||
                  DNS_PACKET_CD(p)((be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->flags) >>
 4) & 1)    != 0 ||
                  DNS_PACKET_RCODE(p) != 0)
                      return -EBADMSG74;

              break;

      default:
              break;
      }

      return 1;
309}

311static int dns_packet_extend(DnsPacket *p, size_t add, void **ret, size_t *start) {
      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 312, __PRETTY_FUNCTION__); } while (0);

      if (p->size + add > p->allocated) {
              size_t a, ms;

              a = PAGE_ALIGN((p->size + add) * 2)ALIGN_TO(((p->size + add) * 2), page_size());

              ms = dns_packet_size_max(p);
              if (a > ms)
                      a = ms;

              if (p->size + add > a)
                      return -EMSGSIZE90;

              if (p->_data) {
                      void *d;

                      d = realloc(p->_data, a);
                      if (!d)
                              return -ENOMEM12;

                      p->_data = d;
              } else {
                      p->_data = malloc(a);
                      if (!p->_data)
                              return -ENOMEM12;

                      memcpy(p->_data, (uint8_t*) p + ALIGN(sizeof(DnsPacket))(((sizeof(DnsPacket)) + 7) & ~7), p->size);
                      memzero((uint8_t*) p->_data + p->size, a - p->size)({ size_t _l_ = (a - p->size); void *_x_ = ((uint8_t*) p->
_data + p->size); _l_ == 0 ? _x_ : memset(_x_, 0, _l_); });
              }

              p->allocated = a;
      }

      if (start)
              *start = p->size;

      if (ret)
              *ret = (uint8_t*) DNS_PACKET_DATA(p) + p->size;

      p->size += add;
      return 0;
354}

356void dns_packet_truncate(DnsPacket *p, size_t sz) {
      Iterator i;
      char *s;
      void *n;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 361, __PRETTY_FUNCTION__); } while (0);

      if (p->size <= sz)
              return;

      HASHMAP_FOREACH_KEY(n, s, p->names, i)for ((i) = ((Iterator) { .idx = ((2147483647 *2U +1U) - 1), .
next_key = ((void*)0) }); hashmap_iterate((p->names), &
(i), (void**)&(n), (const void**) &(s)); ) {

              if (PTR_TO_SIZE(n)((size_t) ((uintptr_t) (n))) < sz)
                      continue;

              hashmap_remove(p->names, s);
              free(s);
      }

      p->size = sz;
376}

378int dns_packet_append_blob(DnsPacket *p, const void *d, size_t l, size_t *start) {
      void *q;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 382, __PRETTY_FUNCTION__); } while (0);

      r = dns_packet_extend(p, l, &q, start);
      if (r < 0)
              return r;

      memcpy(q, d, l);
      return 0;
390}

392int dns_packet_append_uint8(DnsPacket *p, uint8_t v, size_t *start) {
      void *d;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 396, __PRETTY_FUNCTION__); } while (0);

      r = dns_packet_extend(p, sizeof(uint8_t), &d, start);
      if (r < 0)
              return r;

      ((uint8_t*) d)[0] = v;

      return 0;
405}

407int dns_packet_append_uint16(DnsPacket *p, uint16_t v, size_t *start) {
      void *d;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 411, __PRETTY_FUNCTION__); } while (0);

      r = dns_packet_extend(p, sizeof(uint16_t), &d, start);
      if (r < 0)
              return r;

      unaligned_write_be16(d, v);

      return 0;
420}

422int dns_packet_append_uint32(DnsPacket *p, uint32_t v, size_t *start) {
      void *d;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 426, __PRETTY_FUNCTION__); } while (0);

      r = dns_packet_extend(p, sizeof(uint32_t), &d, start);
      if (r < 0)
              return r;

      unaligned_write_be32(d, v);

      return 0;
435}

437int dns_packet_append_string(DnsPacket *p, const char *s, size_t *start) {
      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 438, __PRETTY_FUNCTION__); } while (0);
      assert(s)do { if ((__builtin_expect(!!(!(s)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("s"), "../src/resolve/resolved-dns-packet.c"
, 439, __PRETTY_FUNCTION__); } while (0);

      return dns_packet_append_raw_string(p, s, strlen(s), start);
442}

444int dns_packet_append_raw_string(DnsPacket *p, const void *s, size_t size, size_t *start) {
      void *d;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 448, __PRETTY_FUNCTION__); } while (0);
      assert(s || size == 0)do { if ((__builtin_expect(!!(!(s || size == 0)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("s || size == 0"), "../src/resolve/resolved-dns-packet.c"
, 449, __PRETTY_FUNCTION__); } while (0);

      if (size > 255)
              return -E2BIG7;

      r = dns_packet_extend(p, 1 + size, &d, start);
      if (r < 0)
              return r;

      ((uint8_t*) d)[0] = (uint8_t) size;

      memcpy_safe(((uint8_t*) d) + 1, s, size);

      return 0;
463}

465int dns_packet_append_label(DnsPacket *p, const char *d, size_t l, bool_Bool canonical_candidate, size_t *start) {
      uint8_t *w;
      int r;

      /* Append a label to a packet. Optionally, does this in DNSSEC
       * canonical form, if this label is marked as a candidate for
       * it, and the canonical form logic is enabled for the
       * packet */

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 474, __PRETTY_FUNCTION__); } while (0);
      assert(d)do { if ((__builtin_expect(!!(!(d)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("d"), "../src/resolve/resolved-dns-packet.c"
, 475, __PRETTY_FUNCTION__); } while (0);

      if (l > DNS_LABEL_MAX63)
              return -E2BIG7;

      r = dns_packet_extend(p, 1 + l, (void**) &w, start);
      if (r < 0)
              return r;

      *(w++) = (uint8_t) l;

      if (p->canonical_form && canonical_candidate) {
              size_t i;

              /* Generate in canonical form, as defined by DNSSEC
               * RFC 4034, Section 6.2, i.e. all lower-case. */

              for (i = 0; i < l; i++)
                      w[i] = (uint8_t) ascii_tolower(d[i]);
      } else
              /* Otherwise, just copy the string unaltered. This is
               * essential for DNS-SD, where the casing of labels
               * matters and needs to be retained. */
              memcpy(w, d, l);

      return 0;
501}

503int dns_packet_append_name(
              DnsPacket *p,
              const char *name,
              bool_Bool allow_compression,
              bool_Bool canonical_candidate,
              size_t *start) {

      size_t saved_size;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 513, __PRETTY_FUNCTION__); } while (0);
15
←
Taking false branch→
16
←
Loop condition is false.  Exiting loop→
      assert(name)do { if ((__builtin_expect(!!(!(name)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("name"), "../src/resolve/resolved-dns-packet.c"
, 514, __PRETTY_FUNCTION__); } while (0);
17
←
Assuming 'name' is non-null→
18
←
Taking false branch→
19
←
Loop condition is false.  Exiting loop→

      if (p->refuse_compression)
20
←
Assuming field 'refuse_compression' is false→
21
←
Taking false branch→
              allow_compression = false0;

      saved_size = p->size;

      while (!dns_name_is_root(name)) {
22
←
Assuming the condition is true→
23
←
Loop condition is true.  Entering loop body→
              const char *z = name;
              char label[DNS_LABEL_MAX63];
              size_t n = 0;

              if (allow_compression23.1
'allow_compression' is true
)
24
←
Taking true branch→
                      n = PTR_TO_SIZE(hashmap_get(p->names, name))((size_t) ((uintptr_t) (hashmap_get(p->names, name))));
              if (n > 0) {
25
←
Assuming 'n' is <= 0→
26
←
Taking false branch→
                      assert(n < p->size)do { if ((__builtin_expect(!!(!(n < p->size)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("n < p->size"), "../src/resolve/resolved-dns-packet.c"
, 529, __PRETTY_FUNCTION__); } while (0);

                      if (n < 0x4000) {
                              r = dns_packet_append_uint16(p, 0xC000 | n, NULL((void*)0));
                              if (r < 0)
                                      goto fail;

                              goto done;
                      }
              }

              r = dns_label_unescape(&name, label, sizeof(label));
              if (r < 0)
27
←
Assuming 'r' is >= 0→
28
←
Taking false branch→
                      goto fail;

              r = dns_packet_append_label(p, label, r, canonical_candidate, &n);
              if (r < 0)
29
←
Assuming 'r' is >= 0→
30
←
Taking false branch→
                      goto fail;

              if (allow_compression30.1
'allow_compression' is true
) {
31
←
Taking true branch→
                      _cleanup_free___attribute__((cleanup(freep))) char *s = NULL((void*)0);

                      s = strdup(z);
32
←
Memory is allocated→
                      if (!s) {
33
←
Assuming 's' is non-null→
34
←
Taking false branch→
                              r = -ENOMEM12;
                              goto fail;
                      }

                      r = hashmap_ensure_allocated(&p->names, &dns_name_hash_ops)internal_hashmap_ensure_allocated(&p->names, &dns_name_hash_ops
 );
                      if (r < 0)
35
←
Assuming 'r' is < 0→
36
←
Taking true branch→
                              goto fail;
37
←
Control jumps to line 580→

                      r = hashmap_put(p->names, s, SIZE_TO_PTR(n)((void *) ((uintptr_t) (n))));
                      if (r < 0)
                              goto fail;

                      s = NULL((void*)0);
              }
      }

      r = dns_packet_append_uint8(p, 0, NULL((void*)0));
      if (r < 0)
              return r;

573done:
      if (start)
              *start = saved_size;

      return 0;

579fail:
      dns_packet_truncate(p, saved_size);
38
←
Potential leak of memory pointed to by 's'
      return r;
582}

584int dns_packet_append_key(DnsPacket *p, const DnsResourceKey *k, const DnsAnswerFlags flags, size_t *start) {
      size_t saved_size;
      uint16_t class;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 589, __PRETTY_FUNCTION__); } while (0);
9
←
Taking false branch→
10
←
Loop condition is false.  Exiting loop→
      assert(k)do { if ((__builtin_expect(!!(!(k)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("k"), "../src/resolve/resolved-dns-packet.c"
, 590, __PRETTY_FUNCTION__); } while (0);
11
←
Assuming 'k' is non-null→
12
←
Taking false branch→
13
←
Loop condition is false.  Exiting loop→

      saved_size = p->size;

      r = dns_packet_append_name(p, dns_resource_key_name(k), true1, true1, NULL((void*)0));
14
←
Calling 'dns_packet_append_name'→
      if (r < 0)
              goto fail;

      r = dns_packet_append_uint16(p, k->type, NULL((void*)0));
      if (r < 0)
              goto fail;

      class = flags & DNS_ANSWER_CACHE_FLUSH ? k->class | MDNS_RR_CACHE_FLUSH(1 << 15) : k->class;
      r = dns_packet_append_uint16(p, class, NULL((void*)0));
      if (r < 0)
              goto fail;

      if (start)
              *start = saved_size;

      return 0;

612fail:
      dns_packet_truncate(p, saved_size);
      return r;
615}

617static int dns_packet_append_type_window(DnsPacket *p, uint8_t window, uint8_t length, const uint8_t *types, size_t *start) {
      size_t saved_size;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 621, __PRETTY_FUNCTION__); } while (0);
      assert(types)do { if ((__builtin_expect(!!(!(types)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("types"), "../src/resolve/resolved-dns-packet.c"
, 622, __PRETTY_FUNCTION__); } while (0);
      assert(length > 0)do { if ((__builtin_expect(!!(!(length > 0)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("length > 0"), "../src/resolve/resolved-dns-packet.c"
, 623, __PRETTY_FUNCTION__); } while (0);

      saved_size = p->size;

      r = dns_packet_append_uint8(p, window, NULL((void*)0));
      if (r < 0)
              goto fail;

      r = dns_packet_append_uint8(p, length, NULL((void*)0));
      if (r < 0)
              goto fail;

      r = dns_packet_append_blob(p, types, length, NULL((void*)0));
      if (r < 0)
              goto fail;

      if (start)
              *start = saved_size;

      return 0;
643fail:
      dns_packet_truncate(p, saved_size);
      return r;
646}

648static int dns_packet_append_types(DnsPacket *p, Bitmap *types, size_t *start) {
      Iterator i;
      uint8_t window = 0;
      uint8_t entry = 0;
      uint8_t bitmaps[32] = {};
      unsigned n;
      size_t saved_size;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 657, __PRETTY_FUNCTION__); } while (0);

      saved_size = p->size;

      BITMAP_FOREACH(n, types, i)for ((i).idx = 0; bitmap_iterate((types), &(i), (unsigned
*)&(n)); ) {
              assert(n <= 0xffff)do { if ((__builtin_expect(!!(!(n <= 0xffff)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("n <= 0xffff"), "../src/resolve/resolved-dns-packet.c"
, 662, __PRETTY_FUNCTION__); } while (0);

              if ((n >> 8) != window && bitmaps[entry / 8] != 0) {
                      r = dns_packet_append_type_window(p, window, entry / 8 + 1, bitmaps, NULL((void*)0));
                      if (r < 0)
                              goto fail;

                      zero(bitmaps)(({ size_t _l_ = (sizeof(bitmaps)); void *_x_ = (&(bitmaps
)); _l_ == 0 ? _x_ : memset(_x_, 0, _l_); }));
              }

              window = n >> 8;
              entry = n & 255;

              bitmaps[entry / 8] |= 1 << (7 - (entry % 8));
      }

      if (bitmaps[entry / 8] != 0) {
              r = dns_packet_append_type_window(p, window, entry / 8 + 1, bitmaps, NULL((void*)0));
              if (r < 0)
                      goto fail;
      }

      if (start)
              *start = saved_size;

      return 0;
688fail:
      dns_packet_truncate(p, saved_size);
      return r;
691}

693/* Append the OPT pseudo-RR described in RFC6891 */
694int dns_packet_append_opt(DnsPacket *p, uint16_t max_udp_size, bool_Bool edns0_do, int rcode, size_t *start) {
      size_t saved_size;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 698, __PRETTY_FUNCTION__); } while (0);
      /* we must never advertise supported packet size smaller than the legacy max */
      assert(max_udp_size >= DNS_PACKET_UNICAST_SIZE_MAX)do { if ((__builtin_expect(!!(!(max_udp_size >= 512u)),0))
) log_assert_failed_realm(LOG_REALM_SYSTEMD, ("max_udp_size >= DNS_PACKET_UNICAST_SIZE_MAX"
), "../src/resolve/resolved-dns-packet.c", 700, __PRETTY_FUNCTION__
); } while (0);
      assert(rcode >= 0)do { if ((__builtin_expect(!!(!(rcode >= 0)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("rcode >= 0"), "../src/resolve/resolved-dns-packet.c"
, 701, __PRETTY_FUNCTION__); } while (0);
      assert(rcode <= _DNS_RCODE_MAX)do { if ((__builtin_expect(!!(!(rcode <= _DNS_RCODE_MAX)),
0))) log_assert_failed_realm(LOG_REALM_SYSTEMD, ("rcode <= _DNS_RCODE_MAX"
), "../src/resolve/resolved-dns-packet.c", 702, __PRETTY_FUNCTION__
); } while (0);

      if (p->opt_start != (size_t) -1)
              return -EBUSY16;

      assert(p->opt_size == (size_t) -1)do { if ((__builtin_expect(!!(!(p->opt_size == (size_t) -1
)),0))) log_assert_failed_realm(LOG_REALM_SYSTEMD, ("p->opt_size == (size_t) -1"
), "../src/resolve/resolved-dns-packet.c", 707, __PRETTY_FUNCTION__
); } while (0);

      saved_size = p->size;

      /* empty name */
      r = dns_packet_append_uint8(p, 0, NULL((void*)0));
      if (r < 0)
              return r;

      /* type */
      r = dns_packet_append_uint16(p, DNS_TYPE_OPT, NULL((void*)0));
      if (r < 0)
              goto fail;

      /* class: maximum udp packet that can be received */
      r = dns_packet_append_uint16(p, max_udp_size, NULL((void*)0));
      if (r < 0)
              goto fail;

      /* extended RCODE and VERSION */
      r = dns_packet_append_uint16(p, ((uint16_t) rcode & 0x0FF0) << 4, NULL((void*)0));
      if (r < 0)
              goto fail;

      /* flags: DNSSEC OK (DO), see RFC3225 */
      r = dns_packet_append_uint16(p, edns0_do ? EDNS0_OPT_DO(1<<15) : 0, NULL((void*)0));
      if (r < 0)
              goto fail;

      /* RDLENGTH */
      if (edns0_do && !DNS_PACKET_QR(p)((be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->flags) >>
 15) & 1)) {
              /* If DO is on and this is not a reply, also append RFC6975 Algorithm data */

              static const uint8_t rfc6975[] = {

                      0, 5, /* OPTION_CODE: DAU */
743#if HAVE_GCRYPT1 && GCRYPT_VERSION_NUMBER0x010903 >= 0x010600
                      0, 7, /* LIST_LENGTH */
745#else
                      0, 6, /* LIST_LENGTH */
747#endif
                      DNSSEC_ALGORITHM_RSASHA1,
                      DNSSEC_ALGORITHM_RSASHA1_NSEC3_SHA1,
                      DNSSEC_ALGORITHM_RSASHA256,
                      DNSSEC_ALGORITHM_RSASHA512,
                      DNSSEC_ALGORITHM_ECDSAP256SHA256,
                      DNSSEC_ALGORITHM_ECDSAP384SHA384,
754#if HAVE_GCRYPT1 && GCRYPT_VERSION_NUMBER0x010903 >= 0x010600
                      DNSSEC_ALGORITHM_ED25519,
756#endif

                      0, 6, /* OPTION_CODE: DHU */
                      0, 3, /* LIST_LENGTH */
                      DNSSEC_DIGEST_SHA1,
                      DNSSEC_DIGEST_SHA256,
                      DNSSEC_DIGEST_SHA384,

                      0, 7, /* OPTION_CODE: N3U */
                      0, 1, /* LIST_LENGTH */
                      NSEC3_ALGORITHM_SHA1,
              };

              r = dns_packet_append_uint16(p, sizeof(rfc6975), NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_blob(p, rfc6975, sizeof(rfc6975), NULL((void*)0));
      } else
              r = dns_packet_append_uint16(p, 0, NULL((void*)0));
      if (r < 0)
              goto fail;

      DNS_PACKET_HEADER(p)((DnsPacketHeader*) DNS_PACKET_DATA(p))->arcount = htobe16(DNS_PACKET_ARCOUNT(p)be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->arcount) + 1);

      p->opt_start = saved_size;
      p->opt_size = p->size - saved_size;

      if (start)
              *start = saved_size;

      return 0;

789fail:
      dns_packet_truncate(p, saved_size);
      return r;
792}

794int dns_packet_truncate_opt(DnsPacket *p) {
      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 795, __PRETTY_FUNCTION__); } while (0);

      if (p->opt_start == (size_t) -1) {
              assert(p->opt_size == (size_t) -1)do { if ((__builtin_expect(!!(!(p->opt_size == (size_t) -1
)),0))) log_assert_failed_realm(LOG_REALM_SYSTEMD, ("p->opt_size == (size_t) -1"
), "../src/resolve/resolved-dns-packet.c", 798, __PRETTY_FUNCTION__
); } while (0);
              return 0;
      }

      assert(p->opt_size != (size_t) -1)do { if ((__builtin_expect(!!(!(p->opt_size != (size_t) -1
)),0))) log_assert_failed_realm(LOG_REALM_SYSTEMD, ("p->opt_size != (size_t) -1"
), "../src/resolve/resolved-dns-packet.c", 802, __PRETTY_FUNCTION__
); } while (0);
      assert(DNS_PACKET_ARCOUNT(p) > 0)do { if ((__builtin_expect(!!(!(be16toh(((DnsPacketHeader*) DNS_PACKET_DATA
(p))->arcount) > 0)),0))) log_assert_failed_realm(LOG_REALM_SYSTEMD
, ("DNS_PACKET_ARCOUNT(p) > 0"), "../src/resolve/resolved-dns-packet.c"
, 803, __PRETTY_FUNCTION__); } while (0);

      if (p->opt_start + p->opt_size != p->size)
              return -EBUSY16;

      dns_packet_truncate(p, p->opt_start);
      DNS_PACKET_HEADER(p)((DnsPacketHeader*) DNS_PACKET_DATA(p))->arcount = htobe16(DNS_PACKET_ARCOUNT(p)be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->arcount) - 1);
      p->opt_start = p->opt_size = (size_t) -1;

      return 1;
813}

815int dns_packet_append_rr(DnsPacket *p, const DnsResourceRecord *rr, const DnsAnswerFlags flags, size_t *start, size_t *rdata_start) {

      size_t saved_size, rdlength_offset, end, rdlength, rds;
      uint32_t ttl;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 821, __PRETTY_FUNCTION__); } while (0);
      assert(rr)do { if ((__builtin_expect(!!(!(rr)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("rr"), "../src/resolve/resolved-dns-packet.c"
, 822, __PRETTY_FUNCTION__); } while (0);

      saved_size = p->size;

      r = dns_packet_append_key(p, rr->key, flags, NULL((void*)0));
      if (r < 0)
              goto fail;

      ttl = flags & DNS_ANSWER_GOODBYE ? 0 : rr->ttl;
      r = dns_packet_append_uint32(p, ttl, NULL((void*)0));
      if (r < 0)
              goto fail;

      /* Initially we write 0 here */
      r = dns_packet_append_uint16(p, 0, &rdlength_offset);
      if (r < 0)
              goto fail;

      rds = p->size - saved_size;

      switch (rr->unparseable ? _DNS_TYPE_INVALID : rr->key->type) {

      case DNS_TYPE_SRV:
              r = dns_packet_append_uint16(p, rr->srv.priority, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint16(p, rr->srv.weight, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint16(p, rr->srv.port, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_name(p, rr->srv.name, true1, false0, NULL((void*)0));
              break;

      case DNS_TYPE_PTR:
      case DNS_TYPE_NS:
      case DNS_TYPE_CNAME:
      case DNS_TYPE_DNAME:
              r = dns_packet_append_name(p, rr->ptr.name, true1, false0, NULL((void*)0));
              break;

      case DNS_TYPE_HINFO:
              r = dns_packet_append_string(p, rr->hinfo.cpu, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_string(p, rr->hinfo.os, NULL((void*)0));
              break;

      case DNS_TYPE_SPF: /* exactly the same as TXT */
      case DNS_TYPE_TXT:

              if (!rr->txt.items) {
                      /* RFC 6763, section 6.1 suggests to generate
                       * single empty string for an empty array. */

                      r = dns_packet_append_raw_string(p, NULL((void*)0), 0, NULL((void*)0));
                      if (r < 0)
                              goto fail;
              } else {
                      DnsTxtItem *i;

                      LIST_FOREACH(items, i, rr->txt.items)for ((i) = (rr->txt.items); (i); (i) = (i)->items_next) {
                              r = dns_packet_append_raw_string(p, i->data, i->length, NULL((void*)0));
                              if (r < 0)
                                      goto fail;
                      }
              }

              r = 0;
              break;

      case DNS_TYPE_A:
              r = dns_packet_append_blob(p, &rr->a.in_addr, sizeof(struct in_addr), NULL((void*)0));
              break;

      case DNS_TYPE_AAAA:
              r = dns_packet_append_blob(p, &rr->aaaa.in6_addr, sizeof(struct in6_addr), NULL((void*)0));
              break;

      case DNS_TYPE_SOA:
              r = dns_packet_append_name(p, rr->soa.mname, true1, false0, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_name(p, rr->soa.rname, true1, false0, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint32(p, rr->soa.serial, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint32(p, rr->soa.refresh, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint32(p, rr->soa.retry, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint32(p, rr->soa.expire, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint32(p, rr->soa.minimum, NULL((void*)0));
              break;

      case DNS_TYPE_MX:
              r = dns_packet_append_uint16(p, rr->mx.priority, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_name(p, rr->mx.exchange, true1, false0, NULL((void*)0));
              break;

      case DNS_TYPE_LOC:
              r = dns_packet_append_uint8(p, rr->loc.version, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint8(p, rr->loc.size, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint8(p, rr->loc.horiz_pre, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint8(p, rr->loc.vert_pre, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint32(p, rr->loc.latitude, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint32(p, rr->loc.longitude, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint32(p, rr->loc.altitude, NULL((void*)0));
              break;

      case DNS_TYPE_DS:
              r = dns_packet_append_uint16(p, rr->ds.key_tag, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint8(p, rr->ds.algorithm, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint8(p, rr->ds.digest_type, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_blob(p, rr->ds.digest, rr->ds.digest_size, NULL((void*)0));
              break;

      case DNS_TYPE_SSHFP:
              r = dns_packet_append_uint8(p, rr->sshfp.algorithm, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint8(p, rr->sshfp.fptype, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_blob(p, rr->sshfp.fingerprint, rr->sshfp.fingerprint_size, NULL((void*)0));
              break;

      case DNS_TYPE_DNSKEY:
              r = dns_packet_append_uint16(p, rr->dnskey.flags, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint8(p, rr->dnskey.protocol, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint8(p, rr->dnskey.algorithm, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_blob(p, rr->dnskey.key, rr->dnskey.key_size, NULL((void*)0));
              break;

      case DNS_TYPE_RRSIG:
              r = dns_packet_append_uint16(p, rr->rrsig.type_covered, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint8(p, rr->rrsig.algorithm, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint8(p, rr->rrsig.labels, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint32(p, rr->rrsig.original_ttl, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint32(p, rr->rrsig.expiration, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint32(p, rr->rrsig.inception, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint16(p, rr->rrsig.key_tag, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_name(p, rr->rrsig.signer, false0, true1, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_blob(p, rr->rrsig.signature, rr->rrsig.signature_size, NULL((void*)0));
              break;

      case DNS_TYPE_NSEC:
              r = dns_packet_append_name(p, rr->nsec.next_domain_name, false0, false0, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_types(p, rr->nsec.types, NULL((void*)0));
              if (r < 0)
                      goto fail;

              break;

      case DNS_TYPE_NSEC3:
              r = dns_packet_append_uint8(p, rr->nsec3.algorithm, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint8(p, rr->nsec3.flags, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint16(p, rr->nsec3.iterations, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint8(p, rr->nsec3.salt_size, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_blob(p, rr->nsec3.salt, rr->nsec3.salt_size, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint8(p, rr->nsec3.next_hashed_name_size, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_blob(p, rr->nsec3.next_hashed_name, rr->nsec3.next_hashed_name_size, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_types(p, rr->nsec3.types, NULL((void*)0));
              if (r < 0)
                      goto fail;

              break;

      case DNS_TYPE_TLSA:
              r = dns_packet_append_uint8(p, rr->tlsa.cert_usage, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint8(p, rr->tlsa.selector, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_uint8(p, rr->tlsa.matching_type, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_blob(p, rr->tlsa.data, rr->tlsa.data_size, NULL((void*)0));
              break;

      case DNS_TYPE_CAA:
              r = dns_packet_append_uint8(p, rr->caa.flags, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_string(p, rr->caa.tag, NULL((void*)0));
              if (r < 0)
                      goto fail;

              r = dns_packet_append_blob(p, rr->caa.value, rr->caa.value_size, NULL((void*)0));
              break;

      case DNS_TYPE_OPT:
      case DNS_TYPE_OPENPGPKEY:
      case _DNS_TYPE_INVALID: /* unparseable */
      default:

              r = dns_packet_append_blob(p, rr->generic.data, rr->generic.data_size, NULL((void*)0));
              break;
      }
      if (r < 0)
              goto fail;

      /* Let's calculate the actual data size and update the field */
      rdlength = p->size - rdlength_offset - sizeof(uint16_t);
      if (rdlength > 0xFFFF) {
              r = -ENOSPC28;
              goto fail;
      }

      end = p->size;
      p->size = rdlength_offset;
      r = dns_packet_append_uint16(p, rdlength, NULL((void*)0));
      if (r < 0)
              goto fail;
      p->size = end;

      if (start)
              *start = saved_size;

      if (rdata_start)
              *rdata_start = rds;

      return 0;

1157fail:
      dns_packet_truncate(p, saved_size);
      return r;
1160}

1162int dns_packet_append_question(DnsPacket *p, DnsQuestion *q) {
      DnsResourceKey *key;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 1166, __PRETTY_FUNCTION__); } while (0);
1
Assuming 'p' is non-null→
2
←
Taking false branch→
3
←
Loop condition is false.  Exiting loop→

      DNS_QUESTION_FOREACH(key, q)for (size_t __unique_prefix_i17 = ({ (key) = ((q) && (
q)->n_keys > 0) ? (q)->keys[0] : ((void*)0); 0; }); (
q) && (__unique_prefix_i17 < (q)->n_keys); __unique_prefix_i17
++, (key) = (__unique_prefix_i17 < (q)->n_keys ? (q)->
keys[__unique_prefix_i17] : ((void*)0))) {
4
←
Assuming 'q' is non-null→
5
←
Assuming field 'n_keys' is > 0→
6
←
'?' condition is true→
7
←
Loop condition is true.  Entering loop body→
              r = dns_packet_append_key(p, key, 0, NULL((void*)0));
8
←
Calling 'dns_packet_append_key'→
              if (r < 0)
                      return r;
      }

      return 0;
1175}

1177int dns_packet_append_answer(DnsPacket *p, DnsAnswer *a) {
      DnsResourceRecord *rr;
      DnsAnswerFlags flags;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 1182, __PRETTY_FUNCTION__); } while (0);

      DNS_ANSWER_FOREACH_FLAGS(rr, flags, a)for (size_t __unique_prefix_i18 = ({ (rr) = ((a) && (
a)->n_rrs > 0) ? (a)->items[0].rr : ((void*)0); (flags
) = ((a) && (a)->n_rrs > 0) ? (a)->items[0].
flags : 0; 0; }); (a) && (__unique_prefix_i18 < (a
)->n_rrs); __unique_prefix_i18++, (rr) = ((__unique_prefix_i18
 < (a)->n_rrs) ? (a)->items[__unique_prefix_i18].rr :
 ((void*)0)), (flags) = ((__unique_prefix_i18 < (a)->n_rrs
) ? (a)->items[__unique_prefix_i18].flags : 0)) {
              r = dns_packet_append_rr(p, rr, flags, NULL((void*)0), NULL((void*)0));
              if (r < 0)
                      return r;
      }

      return 0;
1191}

1193int dns_packet_read(DnsPacket *p, size_t sz, const void **ret, size_t *start) {
      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 1194, __PRETTY_FUNCTION__); } while (0);

      if (p->rindex + sz > p->size)
              return -EMSGSIZE90;

      if (ret)
              *ret = (uint8_t*) DNS_PACKET_DATA(p) + p->rindex;

      if (start)
              *start = p->rindex;

      p->rindex += sz;
      return 0;
1207}

1209void dns_packet_rewind(DnsPacket *p, size_t idx) {
      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 1210, __PRETTY_FUNCTION__); } while (0);
      assert(idx <= p->size)do { if ((__builtin_expect(!!(!(idx <= p->size)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("idx <= p->size"), "../src/resolve/resolved-dns-packet.c"
, 1211, __PRETTY_FUNCTION__); } while (0);
      assert(idx >= DNS_PACKET_HEADER_SIZE)do { if ((__builtin_expect(!!(!(idx >= sizeof(DnsPacketHeader
))),0))) log_assert_failed_realm(LOG_REALM_SYSTEMD, ("idx >= DNS_PACKET_HEADER_SIZE"
), "../src/resolve/resolved-dns-packet.c", 1212, __PRETTY_FUNCTION__
); } while (0);

      p->rindex = idx;
1215}

1217int dns_packet_read_blob(DnsPacket *p, void *d, size_t sz, size_t *start) {
      const void *q;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 1221, __PRETTY_FUNCTION__); } while (0);
      assert(d)do { if ((__builtin_expect(!!(!(d)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("d"), "../src/resolve/resolved-dns-packet.c"
, 1222, __PRETTY_FUNCTION__); } while (0);

      r = dns_packet_read(p, sz, &q, start);
      if (r < 0)
              return r;

      memcpy(d, q, sz);
      return 0;
1230}

1232static int dns_packet_read_memdup(
              DnsPacket *p, size_t size,
              void **ret, size_t *ret_size,
              size_t *ret_start) {

      const void *src;
      size_t start;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 1241, __PRETTY_FUNCTION__); } while (0);
      assert(ret)do { if ((__builtin_expect(!!(!(ret)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("ret"), "../src/resolve/resolved-dns-packet.c"
, 1242, __PRETTY_FUNCTION__); } while (0);

      r = dns_packet_read(p, size, &src, &start);
      if (r < 0)
              return r;

      if (size <= 0)
              *ret = NULL((void*)0);
      else {
              void *copy;

              copy = memdup(src, size);
              if (!copy)
                      return -ENOMEM12;

              *ret = copy;
      }

      if (ret_size)
              *ret_size = size;
      if (ret_start)
              *ret_start = start;

      return 0;
1266}

1268int dns_packet_read_uint8(DnsPacket *p, uint8_t *ret, size_t *start) {
      const void *d;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 1272, __PRETTY_FUNCTION__); } while (0);

      r = dns_packet_read(p, sizeof(uint8_t), &d, start);
      if (r < 0)
              return r;

      *ret = ((uint8_t*) d)[0];
      return 0;
1280}

1282int dns_packet_read_uint16(DnsPacket *p, uint16_t *ret, size_t *start) {
      const void *d;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 1286, __PRETTY_FUNCTION__); } while (0);

      r = dns_packet_read(p, sizeof(uint16_t), &d, start);
      if (r < 0)
              return r;

      *ret = unaligned_read_be16(d);

      return 0;
1295}

1297int dns_packet_read_uint32(DnsPacket *p, uint32_t *ret, size_t *start) {
      const void *d;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 1301, __PRETTY_FUNCTION__); } while (0);

      r = dns_packet_read(p, sizeof(uint32_t), &d, start);
      if (r < 0)
              return r;

      *ret = unaligned_read_be32(d);

      return 0;
1310}

1312int dns_packet_read_string(DnsPacket *p, char **ret, size_t *start) {
      _cleanup_(rewind_dns_packet)__attribute__((cleanup(rewind_dns_packet))) DnsPacketRewinder rewinder;
      const void *d;
      char *t;
      uint8_t c;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 1319, __PRETTY_FUNCTION__); } while (0);
      INIT_REWINDER(rewinder, p)do { rewinder.packet = p; rewinder.saved_rindex = p->rindex
; } while (0);

      r = dns_packet_read_uint8(p, &c, NULL((void*)0));
      if (r < 0)
              return r;

      r = dns_packet_read(p, c, &d, NULL((void*)0));
      if (r < 0)
              return r;

      if (memchr(d, 0, c))
              return -EBADMSG74;

      t = strndup(d, c);
      if (!t)
              return -ENOMEM12;

      if (!utf8_is_valid(t)) {
              free(t);
              return -EBADMSG74;
      }

      *ret = t;

      if (start)
              *start = rewinder.saved_rindex;
      CANCEL_REWINDER(rewinder)do { rewinder.packet = ((void*)0); } while (0);

      return 0;
1349}

1351int dns_packet_read_raw_string(DnsPacket *p, const void **ret, size_t *size, size_t *start) {
      _cleanup_(rewind_dns_packet)__attribute__((cleanup(rewind_dns_packet))) DnsPacketRewinder rewinder;
      uint8_t c;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 1356, __PRETTY_FUNCTION__); } while (0);
      INIT_REWINDER(rewinder, p)do { rewinder.packet = p; rewinder.saved_rindex = p->rindex
; } while (0);

      r = dns_packet_read_uint8(p, &c, NULL((void*)0));
      if (r < 0)
              return r;

      r = dns_packet_read(p, c, ret, NULL((void*)0));
      if (r < 0)
              return r;

      if (size)
              *size = c;
      if (start)
              *start = rewinder.saved_rindex;
      CANCEL_REWINDER(rewinder)do { rewinder.packet = ((void*)0); } while (0);

      return 0;
1374}

1376int dns_packet_read_name(
              DnsPacket *p,
              char **_ret,
              bool_Bool allow_compression,
              size_t *start) {

      _cleanup_(rewind_dns_packet)__attribute__((cleanup(rewind_dns_packet))) DnsPacketRewinder rewinder;
      size_t after_rindex = 0, jump_barrier;
      _cleanup_free___attribute__((cleanup(freep))) char *ret = NULL((void*)0);
      size_t n = 0, allocated = 0;
      bool_Bool first = true1;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 1389, __PRETTY_FUNCTION__); } while (0);
      assert(_ret)do { if ((__builtin_expect(!!(!(_ret)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("_ret"), "../src/resolve/resolved-dns-packet.c"
, 1390, __PRETTY_FUNCTION__); } while (0);
      INIT_REWINDER(rewinder, p)do { rewinder.packet = p; rewinder.saved_rindex = p->rindex
; } while (0);
      jump_barrier = p->rindex;

      if (p->refuse_compression)
              allow_compression = false0;

      for (;;) {
              uint8_t c, d;

              r = dns_packet_read_uint8(p, &c, NULL((void*)0));
              if (r < 0)
                      return r;

              if (c == 0)
                      /* End of name */
                      break;
              else if (c <= 63) {
                      const char *label;

                      /* Literal label */
                      r = dns_packet_read(p, c, (const void**) &label, NULL((void*)0));
                      if (r < 0)
                              return r;

                      if (!GREEDY_REALLOC(ret, allocated, n + !first + DNS_LABEL_ESCAPED_MAX)greedy_realloc((void**) &(ret), &(allocated), (n + !first
 + (63*4+1)), sizeof((ret)[0])))
                              return -ENOMEM12;

                      if (first)
                              first = false0;
                      else
                              ret[n++] = '.';

                      r = dns_label_escape(label, c, ret + n, DNS_LABEL_ESCAPED_MAX(63*4+1));
                      if (r < 0)
                              return r;

                      n += r;
                      continue;
              } else if (allow_compression && (c & 0xc0) == 0xc0) {
                      uint16_t ptr;

                      /* Pointer */
                      r = dns_packet_read_uint8(p, &d, NULL((void*)0));
                      if (r < 0)
                              return r;

                      ptr = (uint16_t) (c & ~0xc0) << 8 | (uint16_t) d;
                      if (ptr < DNS_PACKET_HEADER_SIZEsizeof(DnsPacketHeader) || ptr >= jump_barrier)
                              return -EBADMSG74;

                      if (after_rindex == 0)
                              after_rindex = p->rindex;

                      /* Jumps are limited to a "prior occurrence" (RFC-1035 4.1.4) */
                      jump_barrier = ptr;
                      p->rindex = ptr;
              } else
                      return -EBADMSG74;
      }

      if (!GREEDY_REALLOC(ret, allocated, n + 1)greedy_realloc((void**) &(ret), &(allocated), (n + 1)
, sizeof((ret)[0])))
              return -ENOMEM12;

      ret[n] = 0;

      if (after_rindex != 0)
              p->rindex= after_rindex;

      *_ret = TAKE_PTR(ret)({ typeof(ret) _ptr_ = (ret); (ret) = ((void*)0); _ptr_; });

      if (start)
              *start = rewinder.saved_rindex;
      CANCEL_REWINDER(rewinder)do { rewinder.packet = ((void*)0); } while (0);

      return 0;
1466}

1468static int dns_packet_read_type_window(DnsPacket *p, Bitmap **types, size_t *start) {
      uint8_t window;
      uint8_t length;
      const uint8_t *bitmap;
      uint8_t bit = 0;
      unsigned i;
      bool_Bool found = false0;
      _cleanup_(rewind_dns_packet)__attribute__((cleanup(rewind_dns_packet))) DnsPacketRewinder rewinder;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 1478, __PRETTY_FUNCTION__); } while (0);
      assert(types)do { if ((__builtin_expect(!!(!(types)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("types"), "../src/resolve/resolved-dns-packet.c"
, 1479, __PRETTY_FUNCTION__); } while (0);
      INIT_REWINDER(rewinder, p)do { rewinder.packet = p; rewinder.saved_rindex = p->rindex
; } while (0);

      r = bitmap_ensure_allocated(types);
      if (r < 0)
              return r;

      r = dns_packet_read_uint8(p, &window, NULL((void*)0));
      if (r < 0)
              return r;

      r = dns_packet_read_uint8(p, &length, NULL((void*)0));
      if (r < 0)
              return r;

      if (length == 0 || length > 32)
              return -EBADMSG74;

      r = dns_packet_read(p, length, (const void **)&bitmap, NULL((void*)0));
      if (r < 0)
              return r;

      for (i = 0; i < length; i++) {
              uint8_t bitmask = 1 << 7;

              if (!bitmap[i]) {
                      found = false0;
                      bit += 8;
                      continue;
              }

              found = true1;

              for (; bitmask; bit++, bitmask >>= 1)
                      if (bitmap[i] & bitmask) {
                              uint16_t n;

                              n = (uint16_t) window << 8 | (uint16_t) bit;

                              /* Ignore pseudo-types. see RFC4034 section 4.1.2 */
                              if (dns_type_is_pseudo(n))
                                      continue;

                              r = bitmap_set(*types, n);
                              if (r < 0)
                                      return r;
                      }
      }

      if (!found)
              return -EBADMSG74;

      if (start)
              *start = rewinder.saved_rindex;
      CANCEL_REWINDER(rewinder)do { rewinder.packet = ((void*)0); } while (0);

      return 0;
1536}

1538static int dns_packet_read_type_windows(DnsPacket *p, Bitmap **types, size_t size, size_t *start) {
      _cleanup_(rewind_dns_packet)__attribute__((cleanup(rewind_dns_packet))) DnsPacketRewinder rewinder;
      int r;

      INIT_REWINDER(rewinder, p)do { rewinder.packet = p; rewinder.saved_rindex = p->rindex
; } while (0);

      while (p->rindex < rewinder.saved_rindex + size) {
              r = dns_packet_read_type_window(p, types, NULL((void*)0));
              if (r < 0)
                      return r;

              /* don't read past end of current RR */
              if (p->rindex > rewinder.saved_rindex + size)
                      return -EBADMSG74;
      }

      if (p->rindex != rewinder.saved_rindex + size)
              return -EBADMSG74;

      if (start)
              *start = rewinder.saved_rindex;
      CANCEL_REWINDER(rewinder)do { rewinder.packet = ((void*)0); } while (0);

      return 0;
1562}

1564int dns_packet_read_key(DnsPacket *p, DnsResourceKey **ret, bool_Bool *ret_cache_flush, size_t *start) {
      _cleanup_(rewind_dns_packet)__attribute__((cleanup(rewind_dns_packet))) DnsPacketRewinder rewinder;
      _cleanup_free___attribute__((cleanup(freep))) char *name = NULL((void*)0);
      bool_Bool cache_flush = false0;
      uint16_t class, type;
      DnsResourceKey *key;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 1572, __PRETTY_FUNCTION__); } while (0);
      assert(ret)do { if ((__builtin_expect(!!(!(ret)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("ret"), "../src/resolve/resolved-dns-packet.c"
, 1573, __PRETTY_FUNCTION__); } while (0);
      INIT_REWINDER(rewinder, p)do { rewinder.packet = p; rewinder.saved_rindex = p->rindex
; } while (0);

      r = dns_packet_read_name(p, &name, true1, NULL((void*)0));
      if (r < 0)
              return r;

      r = dns_packet_read_uint16(p, &type, NULL((void*)0));
      if (r < 0)
              return r;

      r = dns_packet_read_uint16(p, &class, NULL((void*)0));
      if (r < 0)
              return r;

      if (p->protocol == DNS_PROTOCOL_MDNS) {
              /* See RFC6762, Section 10.2 */

              if (type != DNS_TYPE_OPT && (class & MDNS_RR_CACHE_FLUSH(1 << 15))) {
                      class &= ~MDNS_RR_CACHE_FLUSH(1 << 15);
                      cache_flush = true1;
              }
      }

      key = dns_resource_key_new_consume(class, type, name);
      if (!key)
              return -ENOMEM12;

      name = NULL((void*)0);
      *ret = key;

      if (ret_cache_flush)
              *ret_cache_flush = cache_flush;
      if (start)
              *start = rewinder.saved_rindex;
      CANCEL_REWINDER(rewinder)do { rewinder.packet = ((void*)0); } while (0);

      return 0;
1611}

1613static bool_Bool loc_size_ok(uint8_t size) {
      uint8_t m = size >> 4, e = size & 0xF;

      return m <= 9 && e <= 9 && (m > 0 || e == 0);
1617}

1619int dns_packet_read_rr(DnsPacket *p, DnsResourceRecord **ret, bool_Bool *ret_cache_flush, size_t *start) {
      _cleanup_(dns_resource_record_unrefp)__attribute__((cleanup(dns_resource_record_unrefp))) DnsResourceRecord *rr = NULL((void*)0);
      _cleanup_(dns_resource_key_unrefp)__attribute__((cleanup(dns_resource_key_unrefp))) DnsResourceKey *key = NULL((void*)0);
      _cleanup_(rewind_dns_packet)__attribute__((cleanup(rewind_dns_packet))) DnsPacketRewinder rewinder;
      size_t offset;
      uint16_t rdlength;
      bool_Bool cache_flush;
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 1628, __PRETTY_FUNCTION__); } while (0);
      assert(ret)do { if ((__builtin_expect(!!(!(ret)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("ret"), "../src/resolve/resolved-dns-packet.c"
, 1629, __PRETTY_FUNCTION__); } while (0);

      INIT_REWINDER(rewinder, p)do { rewinder.packet = p; rewinder.saved_rindex = p->rindex
; } while (0);

      r = dns_packet_read_key(p, &key, &cache_flush, NULL((void*)0));
      if (r < 0)
              return r;

      if (!dns_class_is_valid_rr(key->class) || !dns_type_is_valid_rr(key->type))
              return -EBADMSG74;

      rr = dns_resource_record_new(key);
      if (!rr)
              return -ENOMEM12;

      r = dns_packet_read_uint32(p, &rr->ttl, NULL((void*)0));
      if (r < 0)
              return r;

      /* RFC 2181, Section 8, suggests to
       * treat a TTL with the MSB set as a zero TTL. */
      if (rr->ttl & UINT32_C(0x80000000)0x80000000U)
              rr->ttl = 0;

      r = dns_packet_read_uint16(p, &rdlength, NULL((void*)0));
      if (r < 0)
              return r;

      if (p->rindex + rdlength > p->size)
              return -EBADMSG74;

      offset = p->rindex;

      switch (rr->key->type) {

      case DNS_TYPE_SRV:
              r = dns_packet_read_uint16(p, &rr->srv.priority, NULL((void*)0));
              if (r < 0)
                      return r;
              r = dns_packet_read_uint16(p, &rr->srv.weight, NULL((void*)0));
              if (r < 0)
                      return r;
              r = dns_packet_read_uint16(p, &rr->srv.port, NULL((void*)0));
              if (r < 0)
                      return r;
              r = dns_packet_read_name(p, &rr->srv.name, true1, NULL((void*)0));
              break;

      case DNS_TYPE_PTR:
      case DNS_TYPE_NS:
      case DNS_TYPE_CNAME:
      case DNS_TYPE_DNAME:
              r = dns_packet_read_name(p, &rr->ptr.name, true1, NULL((void*)0));
              break;

      case DNS_TYPE_HINFO:
              r = dns_packet_read_string(p, &rr->hinfo.cpu, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_string(p, &rr->hinfo.os, NULL((void*)0));
              break;

      case DNS_TYPE_SPF: /* exactly the same as TXT */
      case DNS_TYPE_TXT:
              if (rdlength <= 0) {
                      r = dns_txt_item_new_empty(&rr->txt.items);
                      if (r < 0)
                              return r;
              } else {
                      DnsTxtItem *last = NULL((void*)0);

                      while (p->rindex < offset + rdlength) {
                              DnsTxtItem *i;
                              const void *data;
                              size_t sz;

                              r = dns_packet_read_raw_string(p, &data, &sz, NULL((void*)0));
                              if (r < 0)
                                      return r;

                              i = malloc0(offsetof(DnsTxtItem, data) + sz + 1)(calloc(1, (__builtin_offsetof(DnsTxtItem, data) + sz + 1))); /* extra NUL byte at the end */
                              if (!i)
                                      return -ENOMEM12;

                              memcpy(i->data, data, sz);
                              i->length = sz;

                              LIST_INSERT_AFTER(items, rr->txt.items, last, i)do { typeof(*(rr->txt.items)) **_head = &(rr->txt.items
), *_a = (last), *_b = (i); do { if ((__builtin_expect(!!(!(_b
)),0))) log_assert_failed_realm(LOG_REALM_SYSTEMD, ("_b"), "../src/resolve/resolved-dns-packet.c"
, 1717, __PRETTY_FUNCTION__); } while (0); if (!_a) { if ((_b
->items_next = *_head)) _b->items_next->items_prev =
 _b; _b->items_prev = ((void*)0); *_head = _b; } else { if
 ((_b->items_next = _a->items_next)) _b->items_next->
items_prev = _b; _b->items_prev = _a; _a->items_next = _b
; } } while (0);
                              last = i;
                      }
              }

              r = 0;
              break;

      case DNS_TYPE_A:
              r = dns_packet_read_blob(p, &rr->a.in_addr, sizeof(struct in_addr), NULL((void*)0));
              break;

      case DNS_TYPE_AAAA:
              r = dns_packet_read_blob(p, &rr->aaaa.in6_addr, sizeof(struct in6_addr), NULL((void*)0));
              break;

      case DNS_TYPE_SOA:
              r = dns_packet_read_name(p, &rr->soa.mname, true1, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_name(p, &rr->soa.rname, true1, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint32(p, &rr->soa.serial, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint32(p, &rr->soa.refresh, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint32(p, &rr->soa.retry, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint32(p, &rr->soa.expire, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint32(p, &rr->soa.minimum, NULL((void*)0));
              break;

      case DNS_TYPE_MX:
              r = dns_packet_read_uint16(p, &rr->mx.priority, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_name(p, &rr->mx.exchange, true1, NULL((void*)0));
              break;

      case DNS_TYPE_LOC: {
              uint8_t t;
              size_t pos;

              r = dns_packet_read_uint8(p, &t, &pos);
              if (r < 0)
                      return r;

              if (t == 0) {
                      rr->loc.version = t;

                      r = dns_packet_read_uint8(p, &rr->loc.size, NULL((void*)0));
                      if (r < 0)
                              return r;

                      if (!loc_size_ok(rr->loc.size))
                              return -EBADMSG74;

                      r = dns_packet_read_uint8(p, &rr->loc.horiz_pre, NULL((void*)0));
                      if (r < 0)
                              return r;

                      if (!loc_size_ok(rr->loc.horiz_pre))
                              return -EBADMSG74;

                      r = dns_packet_read_uint8(p, &rr->loc.vert_pre, NULL((void*)0));
                      if (r < 0)
                              return r;

                      if (!loc_size_ok(rr->loc.vert_pre))
                              return -EBADMSG74;

                      r = dns_packet_read_uint32(p, &rr->loc.latitude, NULL((void*)0));
                      if (r < 0)
                              return r;

                      r = dns_packet_read_uint32(p, &rr->loc.longitude, NULL((void*)0));
                      if (r < 0)
                              return r;

                      r = dns_packet_read_uint32(p, &rr->loc.altitude, NULL((void*)0));
                      if (r < 0)
                              return r;

                      break;
              } else {
                      dns_packet_rewind(p, pos);
                      rr->unparseable = true1;
                      goto unparseable;
              }
      }

      case DNS_TYPE_DS:
              r = dns_packet_read_uint16(p, &rr->ds.key_tag, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint8(p, &rr->ds.algorithm, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint8(p, &rr->ds.digest_type, NULL((void*)0));
              if (r < 0)
                      return r;

              if (rdlength < 4)
                      return -EBADMSG74;

              r = dns_packet_read_memdup(p, rdlength - 4,
                                         &rr->ds.digest, &rr->ds.digest_size,
                                         NULL((void*)0));
              if (r < 0)
                      return r;

              if (rr->ds.digest_size <= 0)
                      /* the accepted size depends on the algorithm, but for now
                         just ensure that the value is greater than zero */
                      return -EBADMSG74;

              break;

      case DNS_TYPE_SSHFP:
              r = dns_packet_read_uint8(p, &rr->sshfp.algorithm, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint8(p, &rr->sshfp.fptype, NULL((void*)0));
              if (r < 0)
                      return r;

              if (rdlength < 2)
                      return -EBADMSG74;

              r = dns_packet_read_memdup(p, rdlength - 2,
                                         &rr->sshfp.fingerprint, &rr->sshfp.fingerprint_size,
                                         NULL((void*)0));

              if (rr->sshfp.fingerprint_size <= 0)
                      /* the accepted size depends on the algorithm, but for now
                         just ensure that the value is greater than zero */
                      return -EBADMSG74;

              break;

      case DNS_TYPE_DNSKEY:
              r = dns_packet_read_uint16(p, &rr->dnskey.flags, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint8(p, &rr->dnskey.protocol, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint8(p, &rr->dnskey.algorithm, NULL((void*)0));
              if (r < 0)
                      return r;

              if (rdlength < 4)
                      return -EBADMSG74;

              r = dns_packet_read_memdup(p, rdlength - 4,
                                         &rr->dnskey.key, &rr->dnskey.key_size,
                                         NULL((void*)0));

              if (rr->dnskey.key_size <= 0)
                      /* the accepted size depends on the algorithm, but for now
                         just ensure that the value is greater than zero */
                      return -EBADMSG74;

              break;

      case DNS_TYPE_RRSIG:
              r = dns_packet_read_uint16(p, &rr->rrsig.type_covered, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint8(p, &rr->rrsig.algorithm, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint8(p, &rr->rrsig.labels, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint32(p, &rr->rrsig.original_ttl, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint32(p, &rr->rrsig.expiration, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint32(p, &rr->rrsig.inception, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint16(p, &rr->rrsig.key_tag, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_name(p, &rr->rrsig.signer, false0, NULL((void*)0));
              if (r < 0)
                      return r;

              if (rdlength + offset < p->rindex)
                      return -EBADMSG74;

              r = dns_packet_read_memdup(p, offset + rdlength - p->rindex,
                                         &rr->rrsig.signature, &rr->rrsig.signature_size,
                                         NULL((void*)0));

              if (rr->rrsig.signature_size <= 0)
                      /* the accepted size depends on the algorithm, but for now
                         just ensure that the value is greater than zero */
                      return -EBADMSG74;

              break;

      case DNS_TYPE_NSEC: {

              /*
               * RFC6762, section 18.14 explictly states mDNS should use name compression.
               * This contradicts RFC3845, section 2.1.1
               */

              bool_Bool allow_compressed = p->protocol == DNS_PROTOCOL_MDNS;

              r = dns_packet_read_name(p, &rr->nsec.next_domain_name, allow_compressed, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_type_windows(p, &rr->nsec.types, offset + rdlength - p->rindex, NULL((void*)0));

              /* We accept empty NSEC bitmaps. The bit indicating the presence of the NSEC record itself
               * is redundant and in e.g., RFC4956 this fact is used to define a use for NSEC records
               * without the NSEC bit set. */

              break;
      }
      case DNS_TYPE_NSEC3: {
              uint8_t size;

              r = dns_packet_read_uint8(p, &rr->nsec3.algorithm, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint8(p, &rr->nsec3.flags, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint16(p, &rr->nsec3.iterations, NULL((void*)0));
              if (r < 0)
                      return r;

              /* this may be zero */
              r = dns_packet_read_uint8(p, &size, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_memdup(p, size, &rr->nsec3.salt, &rr->nsec3.salt_size, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint8(p, &size, NULL((void*)0));
              if (r < 0)
                      return r;

              if (size <= 0)
                      return -EBADMSG74;

              r = dns_packet_read_memdup(p, size,
                                         &rr->nsec3.next_hashed_name, &rr->nsec3.next_hashed_name_size,
                                         NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_type_windows(p, &rr->nsec3.types, offset + rdlength - p->rindex, NULL((void*)0));

              /* empty non-terminals can have NSEC3 records, so empty bitmaps are allowed */

              break;
      }

      case DNS_TYPE_TLSA:
              r = dns_packet_read_uint8(p, &rr->tlsa.cert_usage, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint8(p, &rr->tlsa.selector, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_uint8(p, &rr->tlsa.matching_type, NULL((void*)0));
              if (r < 0)
                      return r;

              if (rdlength < 3)
                      return -EBADMSG74;

              r = dns_packet_read_memdup(p, rdlength - 3,
                                         &rr->tlsa.data, &rr->tlsa.data_size,
                                         NULL((void*)0));

              if (rr->tlsa.data_size <= 0)
                      /* the accepted size depends on the algorithm, but for now
                         just ensure that the value is greater than zero */
                      return -EBADMSG74;

              break;

      case DNS_TYPE_CAA:
              r = dns_packet_read_uint8(p, &rr->caa.flags, NULL((void*)0));
              if (r < 0)
                      return r;

              r = dns_packet_read_string(p, &rr->caa.tag, NULL((void*)0));
              if (r < 0)
                      return r;

              if (rdlength + offset < p->rindex)
                      return -EBADMSG74;

              r = dns_packet_read_memdup(p,
                                         rdlength + offset - p->rindex,
                                         &rr->caa.value, &rr->caa.value_size, NULL((void*)0));

              break;

      case DNS_TYPE_OPT: /* we only care about the header of OPT for now. */
      case DNS_TYPE_OPENPGPKEY:
      default:
      unparseable:
              r = dns_packet_read_memdup(p, rdlength, &rr->generic.data, &rr->generic.data_size, NULL((void*)0));

              break;
      }
      if (r < 0)
              return r;
      if (p->rindex != offset + rdlength)
              return -EBADMSG74;

      *ret = TAKE_PTR(rr)({ typeof(rr) _ptr_ = (rr); (rr) = ((void*)0); _ptr_; });

      if (ret_cache_flush)
              *ret_cache_flush = cache_flush;
      if (start)
              *start = rewinder.saved_rindex;
      CANCEL_REWINDER(rewinder)do { rewinder.packet = ((void*)0); } while (0);

      return 0;
2079}

2081static bool_Bool opt_is_good(DnsResourceRecord *rr, bool_Bool *rfc6975) {
      const uint8_t* p;
      bool_Bool found_dau_dhu_n3u = false0;
      size_t l;

      /* Checks whether the specified OPT RR is well-formed and whether it contains RFC6975 data (which is not OK in
       * a reply). */

      assert(rr)do { if ((__builtin_expect(!!(!(rr)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("rr"), "../src/resolve/resolved-dns-packet.c"
, 2089, __PRETTY_FUNCTION__); } while (0);
      assert(rr->key->type == DNS_TYPE_OPT)do { if ((__builtin_expect(!!(!(rr->key->type == DNS_TYPE_OPT
)),0))) log_assert_failed_realm(LOG_REALM_SYSTEMD, ("rr->key->type == DNS_TYPE_OPT"
), "../src/resolve/resolved-dns-packet.c", 2090, __PRETTY_FUNCTION__
); } while (0);

      /* Check that the version is 0 */
      if (((rr->ttl >> 16) & UINT32_C(0xFF)0xFFU) != 0) {
              *rfc6975 = false0;
              return true1; /* if it's not version 0, it's OK, but we will ignore the OPT field contents */
      }

      p = rr->opt.data;
      l = rr->opt.data_size;
      while (l > 0) {
              uint16_t option_code, option_length;

              /* At least four bytes for OPTION-CODE and OPTION-LENGTH are required */
              if (l < 4U)
                      return false0;

              option_code = unaligned_read_be16(p);
              option_length = unaligned_read_be16(p + 2);

              if (l < option_length + 4U)
                      return false0;

              /* RFC 6975 DAU, DHU or N3U fields found. */
              if (IN_SET(option_code, 5, 6, 7)({ _Bool _found = 0; static __attribute__ ((unused)) char _static_assert__macros_need_to_be_extended
[20 - sizeof((int[]){5, 6, 7})/sizeof(int)]; switch(option_code
) { case 5: case 6: case 7: _found = 1; break; default: break
; } _found; }))
                      found_dau_dhu_n3u = true1;

              p += option_length + 4U;
              l -= option_length + 4U;
      }

      *rfc6975 = found_dau_dhu_n3u;
      return true1;
2123}

2125static int dns_packet_extract_question(DnsPacket *p, DnsQuestion **ret_question) {
      _cleanup_(dns_question_unrefp)__attribute__((cleanup(dns_question_unrefp))) DnsQuestion *question = NULL((void*)0);
      unsigned n, i;
      int r;

      n = DNS_PACKET_QDCOUNT(p)be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->qdcount);
      if (n > 0) {
              question = dns_question_new(n);
              if (!question)
                      return -ENOMEM12;

              for (i = 0; i < n; i++) {
                      _cleanup_(dns_resource_key_unrefp)__attribute__((cleanup(dns_resource_key_unrefp))) DnsResourceKey *key = NULL((void*)0);
                      bool_Bool cache_flush;

                      r = dns_packet_read_key(p, &key, &cache_flush, NULL((void*)0));
                      if (r < 0)
                              return r;

                      if (cache_flush)
                              return -EBADMSG74;

                      if (!dns_type_is_valid_query(key->type))
                              return -EBADMSG74;

                      r = dns_question_add(question, key);
                      if (r < 0)
                              return r;
              }
      }

      *ret_question = TAKE_PTR(question)({ typeof(question) _ptr_ = (question); (question) = ((void*)
0); _ptr_; });

      return 0;
2159}

2161static int dns_packet_extract_answer(DnsPacket *p, DnsAnswer **ret_answer) {
      _cleanup_(dns_answer_unrefp)__attribute__((cleanup(dns_answer_unrefp))) DnsAnswer *answer = NULL((void*)0);
      unsigned n, i;
      _cleanup_(dns_resource_record_unrefp)__attribute__((cleanup(dns_resource_record_unrefp))) DnsResourceRecord *previous = NULL((void*)0);
      bool_Bool bad_opt = false0;
      int r;

      n = DNS_PACKET_RRCOUNT(p);
      if (n == 0)
              return 0;

      answer = dns_answer_new(n);
      if (!answer)
              return -ENOMEM12;

      for (i = 0; i < n; i++) {
              _cleanup_(dns_resource_record_unrefp)__attribute__((cleanup(dns_resource_record_unrefp))) DnsResourceRecord *rr = NULL((void*)0);
              bool_Bool cache_flush = false0;

              r = dns_packet_read_rr(p, &rr, &cache_flush, NULL((void*)0));
              if (r < 0)
                      return r;

              /* Try to reduce memory usage a bit */
              if (previous)
                      dns_resource_key_reduce(&rr->key, &previous->key);

              if (rr->key->type == DNS_TYPE_OPT) {
                      bool_Bool has_rfc6975;

                      if (p->opt || bad_opt) {
                              /* Multiple OPT RRs? if so, let's ignore all, because there's
                               * something wrong with the server, and if one is valid we wouldn't
                               * know which one. */
                              log_debug("Multiple OPT RRs detected, ignoring all.")({ int _level = (((7))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-packet.c", 2195, __func__, "Multiple OPT RRs detected, ignoring all."
) : -abs(_e); });
                              bad_opt = true1;
                              continue;
                      }

                      if (!dns_name_is_root(dns_resource_key_name(rr->key))) {
                              /* If the OPT RR is not owned by the root domain, then it is bad,
                               * let's ignore it. */
                              log_debug("OPT RR is not owned by root domain, ignoring.")({ int _level = (((7))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-packet.c", 2203, __func__, "OPT RR is not owned by root domain, ignoring."
) : -abs(_e); });
                              bad_opt = true1;
                              continue;
                      }

                      if (i < DNS_PACKET_ANCOUNT(p)be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->ancount) + DNS_PACKET_NSCOUNT(p)be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->nscount)) {
                              /* OPT RR is in the wrong section? Some Belkin routers do this. This
                               * is a hint the EDNS implementation is borked, like the Belkin one
                               * is, hence ignore it. */
                              log_debug("OPT RR in wrong section, ignoring.")({ int _level = (((7))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-packet.c", 2212, __func__, "OPT RR in wrong section, ignoring."
) : -abs(_e); });
                              bad_opt = true1;
                              continue;
                      }

                      if (!opt_is_good(rr, &has_rfc6975)) {
                              log_debug("Malformed OPT RR, ignoring.")({ int _level = (((7))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-packet.c", 2218, __func__, "Malformed OPT RR, ignoring."
) : -abs(_e); });
                              bad_opt = true1;
                              continue;
                      }

                      if (DNS_PACKET_QR(p)((be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->flags) >>
 15) & 1)) {
                              /* Additional checks for responses */

                              if (!DNS_RESOURCE_RECORD_OPT_VERSION_SUPPORTED(rr)) {
                                      /* If this is a reply and we don't know the EDNS version
                                       * then something is weird... */
                                      log_debug("EDNS version newer that our request, bad server.")({ int _level = (((7))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-packet.c", 2229, __func__, "EDNS version newer that our request, bad server."
) : -abs(_e); });
                                      return -EBADMSG74;
                              }

                              if (has_rfc6975) {
                                      /* If the OPT RR contains RFC6975 algorithm data, then this
                                       * is indication that the server just copied the OPT it got
                                       * from us (which contained that data) back into the reply.
                                       * If so, then it doesn't properly support EDNS, as RFC6975
                                       * makes it very clear that the algorithm data should only
                                       * be contained in questions, never in replies. Crappy
                                       * Belkin routers copy the OPT data for example, hence let's
                                       * detect this so that we downgrade early. */
                                      log_debug("OPT RR contained RFC6975 data, ignoring.")({ int _level = (((7))), _e = ((0)), _realm = (LOG_REALM_SYSTEMD
); (log_get_max_level_realm(_realm) >= ((_level) & 0x07
)) ? log_internal_realm(((_realm) << 10 | (_level)), _e
, "../src/resolve/resolved-dns-packet.c", 2242, __func__, "OPT RR contained RFC6975 data, ignoring."
) : -abs(_e); });
                                      bad_opt = true1;
                                      continue;
                              }
                      }

                      p->opt = dns_resource_record_ref(rr);
              } else {
                      /* According to RFC 4795, section 2.9. only the RRs from the Answer section
                       * shall be cached. Hence mark only those RRs as cacheable by default, but
                       * not the ones from the Additional or Authority sections. */
                      DnsAnswerFlags flags =
                              (i < DNS_PACKET_ANCOUNT(p)be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->ancount) ? DNS_ANSWER_CACHEABLE : 0) |
                              (p->protocol == DNS_PROTOCOL_MDNS && !cache_flush ? DNS_ANSWER_SHARED_OWNER : 0);

                      r = dns_answer_add(answer, rr, p->ifindex, flags);
                      if (r < 0)
                              return r;
              }

              /* Remember this RR, so that we potentically can merge it's ->key object with the
               * next RR. Note that we only do this if we actually decided to keep the RR around.
               */
              dns_resource_record_unref(previous);
              previous = dns_resource_record_ref(rr);
      }

      if (bad_opt)
              p->opt = dns_resource_record_unref(p->opt);

      *ret_answer = TAKE_PTR(answer)({ typeof(answer) _ptr_ = (answer); (answer) = ((void*)0); _ptr_
; });

      return 0;
2275}

2277int dns_packet_extract(DnsPacket *p) {
      _cleanup_(dns_question_unrefp)__attribute__((cleanup(dns_question_unrefp))) DnsQuestion *question = NULL((void*)0);
      _cleanup_(dns_answer_unrefp)__attribute__((cleanup(dns_answer_unrefp))) DnsAnswer *answer = NULL((void*)0);
      _cleanup_(rewind_dns_packet)__attribute__((cleanup(rewind_dns_packet))) DnsPacketRewinder rewinder = {};
      int r;

      if (p->extracted)
              return 0;

      INIT_REWINDER(rewinder, p)do { rewinder.packet = p; rewinder.saved_rindex = p->rindex
; } while (0);
      dns_packet_rewind(p, DNS_PACKET_HEADER_SIZEsizeof(DnsPacketHeader));

      r = dns_packet_extract_question(p, &question);
      if (r < 0)
              return r;

      r = dns_packet_extract_answer(p, &answer);
      if (r < 0)
              return r;

      p->question = TAKE_PTR(question)({ typeof(question) _ptr_ = (question); (question) = ((void*)
0); _ptr_; });
      p->answer = TAKE_PTR(answer)({ typeof(answer) _ptr_ = (answer); (answer) = ((void*)0); _ptr_
; });

      p->extracted = true1;

      /* no CANCEL, always rewind */
      return 0;
2304}

2306int dns_packet_is_reply_for(DnsPacket *p, const DnsResourceKey *key) {
      int r;

      assert(p)do { if ((__builtin_expect(!!(!(p)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("p"), "../src/resolve/resolved-dns-packet.c"
, 2309, __PRETTY_FUNCTION__); } while (0);
      assert(key)do { if ((__builtin_expect(!!(!(key)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("key"), "../src/resolve/resolved-dns-packet.c"
, 2310, __PRETTY_FUNCTION__); } while (0);

      /* Checks if the specified packet is a reply for the specified
       * key and the specified key is the only one in the question
       * section. */

      if (DNS_PACKET_QR(p)((be16toh(((DnsPacketHeader*) DNS_PACKET_DATA(p))->flags) >>
 15) & 1) != 1)
              return 0;

      /* Let's unpack the packet, if that hasn't happened yet. */
      r = dns_packet_extract(p);
      if (r < 0)
              return r;

      if (!p->question)
              return 0;

      if (p->question->n_keys != 1)
              return 0;

      return dns_resource_key_equal(p->question->keys[0], key);
2331}

2333static void dns_packet_hash_func(const void *p, struct siphash *state) {
      const DnsPacket *s = p;

      assert(s)do { if ((__builtin_expect(!!(!(s)),0))) log_assert_failed_realm
(LOG_REALM_SYSTEMD, ("s"), "../src/resolve/resolved-dns-packet.c"
, 2336, __PRETTY_FUNCTION__); } while (0);

      siphash24_compress(&s->size, sizeof(s->size), state);
      siphash24_compress(DNS_PACKET_DATA((DnsPacket*) s), s->size, state);
2340}

2342static int dns_packet_compare_func(const void *a, const void *b) {
      const DnsPacket *x = a, *y = b;

      if (x->size < y->size)
              return -1;
      if (x->size > y->size)
              return 1;

      return memcmp(DNS_PACKET_DATA((DnsPacket*) x), DNS_PACKET_DATA((DnsPacket*) y), x->size);
2351}

2353const struct hash_ops dns_packet_hash_ops = {
      .hash = dns_packet_hash_func,
      .compare = dns_packet_compare_func
2356};

2358static const char* const dns_rcode_table[_DNS_RCODE_MAX_DEFINED] = {
      [DNS_RCODE_SUCCESS] = "SUCCESS",
      [DNS_RCODE_FORMERR] = "FORMERR",
      [DNS_RCODE_SERVFAIL] = "SERVFAIL",
      [DNS_RCODE_NXDOMAIN] = "NXDOMAIN",
      [DNS_RCODE_NOTIMP] = "NOTIMP",
      [DNS_RCODE_REFUSED] = "REFUSED",
      [DNS_RCODE_YXDOMAIN] = "YXDOMAIN",
      [DNS_RCODE_YXRRSET] = "YRRSET",
      [DNS_RCODE_NXRRSET] = "NXRRSET",
      [DNS_RCODE_NOTAUTH] = "NOTAUTH",
      [DNS_RCODE_NOTZONE] = "NOTZONE",
      [DNS_RCODE_BADVERS] = "BADVERS",
      [DNS_RCODE_BADKEY] = "BADKEY",
      [DNS_RCODE_BADTIME] = "BADTIME",
      [DNS_RCODE_BADMODE] = "BADMODE",
      [DNS_RCODE_BADNAME] = "BADNAME",
      [DNS_RCODE_BADALG] = "BADALG",
      [DNS_RCODE_BADTRUNC] = "BADTRUNC",
      [DNS_RCODE_BADCOOKIE] = "BADCOOKIE",
2378};
2379DEFINE_STRING_TABLE_LOOKUP(dns_rcode, int)const char *dns_rcode_to_string(int i) { if (i < 0 || i >=
 (int) __extension__ (__builtin_choose_expr( !__builtin_types_compatible_p
(typeof(dns_rcode_table), typeof(&*(dns_rcode_table))), sizeof
(dns_rcode_table)/sizeof((dns_rcode_table)[0]), ((void)0)))) return
 ((void*)0); return dns_rcode_table[i]; } int dns_rcode_from_string
(const char *s) { return (int) string_table_lookup(dns_rcode_table
, __extension__ (__builtin_choose_expr( !__builtin_types_compatible_p
(typeof(dns_rcode_table), typeof(&*(dns_rcode_table))), sizeof
(dns_rcode_table)/sizeof((dns_rcode_table)[0]), ((void)0))), s
); };

2381static const char* const dns_protocol_table[_DNS_PROTOCOL_MAX] = {
      [DNS_PROTOCOL_DNS] = "dns",
      [DNS_PROTOCOL_MDNS] = "mdns",
      [DNS_PROTOCOL_LLMNR] = "llmnr",
2385};
2386DEFINE_STRING_TABLE_LOOKUP(dns_protocol, DnsProtocol)const char *dns_protocol_to_string(DnsProtocol i) { if (i <
|| i >= (DnsProtocol) __extension__ (__builtin_choose_expr
( !__builtin_types_compatible_p(typeof(dns_protocol_table), typeof
(&*(dns_protocol_table))), sizeof(dns_protocol_table)/sizeof
((dns_protocol_table)[0]), ((void)0)))) return ((void*)0); return
 dns_protocol_table[i]; } DnsProtocol dns_protocol_from_string
(const char *s) { return (DnsProtocol) string_table_lookup(dns_protocol_table
, __extension__ (__builtin_choose_expr( !__builtin_types_compatible_p
(typeof(dns_protocol_table), typeof(&*(dns_protocol_table
))), sizeof(dns_protocol_table)/sizeof((dns_protocol_table)[0
]), ((void)0))), s); };