summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authormartin <martin@NetBSD.org>2019-09-06 19:51:54 +0000
committermartin <martin@NetBSD.org>2019-09-06 19:51:54 +0000
commit859ffd83c5d1664bee95cecad4fe0b6195976e26 (patch)
tree62ff495ed75f014d841c3c2c70b65e11390c51f8 /lib
parentd4000d05a5b49a197105f65fab54ad3b080f266c (diff)
Pull up following revision(s) (requested by maya in ticket #186):
lib/libc/nameser/ns_name.c: revision 1.12 Since we advance cp after the bounds check, we need to test for bounds again before using it. Discovered via fuzzing, reported by enh at google, via: https://android-review.googlesource.com/c/platform/bionic/+/1093130
Diffstat (limited to 'lib')
-rw-r--r--lib/libc/nameser/ns_name.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/lib/libc/nameser/ns_name.c b/lib/libc/nameser/ns_name.c
index 3a48c21df83..381e2133546 100644
--- a/lib/libc/nameser/ns_name.c
+++ b/lib/libc/nameser/ns_name.c
@@ -1,4 +1,4 @@
-/* $NetBSD: ns_name.c,v 1.11 2014/03/07 01:07:01 christos Exp $ */
+/* $NetBSD: ns_name.c,v 1.11.28.1 2019/09/06 19:51:54 martin Exp $ */
/*
* Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
@@ -22,7 +22,7 @@
#ifdef notdef
static const char rcsid[] = "Id: ns_name.c,v 1.11 2009/01/23 19:59:16 each Exp";
#else
-__RCSID("$NetBSD: ns_name.c,v 1.11 2014/03/07 01:07:01 christos Exp $");
+__RCSID("$NetBSD: ns_name.c,v 1.11.28.1 2019/09/06 19:51:54 martin Exp $");
#endif
#endif
@@ -696,7 +696,7 @@ ns_name_skip(const u_char **ptrptr, const u_char *eom)
{
const u_char *cp;
u_int n;
- int l;
+ int l = 0;
cp = *ptrptr;
while (cp < eom && (n = *cp++) != 0) {
@@ -706,7 +706,7 @@ ns_name_skip(const u_char **ptrptr, const u_char *eom)
cp += n;
continue;
case NS_TYPE_ELT: /*%< EDNS0 extended label */
- if ((l = labellen(cp - 1)) < 0) {
+ if (cp < eom && (l = labellen(cp - 1)) < 0) {
errno = EMSGSIZE; /*%< XXX */
return (-1);
}