diff options
| author | martin <martin@NetBSD.org> | 2019-09-06 19:51:54 +0000 |
|---|---|---|
| committer | martin <martin@NetBSD.org> | 2019-09-06 19:51:54 +0000 |
| commit | 859ffd83c5d1664bee95cecad4fe0b6195976e26 (patch) | |
| tree | 62ff495ed75f014d841c3c2c70b65e11390c51f8 /lib | |
| parent | d4000d05a5b49a197105f65fab54ad3b080f266c (diff) | |
Pull up following revision(s) (requested by maya in ticket #186):
lib/libc/nameser/ns_name.c: revision 1.12
Since we advance cp after the bounds check, we need to test for bounds
again before using it. Discovered via fuzzing, reported by enh at google, via:
https://android-review.googlesource.com/c/platform/bionic/+/1093130
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/libc/nameser/ns_name.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/lib/libc/nameser/ns_name.c b/lib/libc/nameser/ns_name.c index 3a48c21df83..381e2133546 100644 --- a/lib/libc/nameser/ns_name.c +++ b/lib/libc/nameser/ns_name.c @@ -1,4 +1,4 @@ -/* $NetBSD: ns_name.c,v 1.11 2014/03/07 01:07:01 christos Exp $ */ +/* $NetBSD: ns_name.c,v 1.11.28.1 2019/09/06 19:51:54 martin Exp $ */ /* * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC") @@ -22,7 +22,7 @@ #ifdef notdef static const char rcsid[] = "Id: ns_name.c,v 1.11 2009/01/23 19:59:16 each Exp"; #else -__RCSID("$NetBSD: ns_name.c,v 1.11 2014/03/07 01:07:01 christos Exp $"); +__RCSID("$NetBSD: ns_name.c,v 1.11.28.1 2019/09/06 19:51:54 martin Exp $"); #endif #endif @@ -696,7 +696,7 @@ ns_name_skip(const u_char **ptrptr, const u_char *eom) { const u_char *cp; u_int n; - int l; + int l = 0; cp = *ptrptr; while (cp < eom && (n = *cp++) != 0) { @@ -706,7 +706,7 @@ ns_name_skip(const u_char **ptrptr, const u_char *eom) cp += n; continue; case NS_TYPE_ELT: /*%< EDNS0 extended label */ - if ((l = labellen(cp - 1)) < 0) { + if (cp < eom && (l = labellen(cp - 1)) < 0) { errno = EMSGSIZE; /*%< XXX */ return (-1); } |
