diff options
| author | Florian Weimer <fweimer@redhat.com> | 2017-04-13 11:56:28 +0200 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2017-04-13 11:56:28 +0200 |
| commit | c803cb9b24c6cea15698768e4301e963b98e742c (patch) | |
| tree | 8b1dfb346ea50ccd7f1da044c65b60bb4b9aee27 /resolv/ns_name.c | |
| parent | a7ff1da8239a5f0e1927db9d5310f53cfea97fc2 (diff) | |
| download | glibc-c803cb9b24c6cea15698768e4301e963b98e742c.zip glibc-c803cb9b24c6cea15698768e4301e963b98e742c.tar.gz glibc-c803cb9b24c6cea15698768e4301e963b98e742c.tar.bz2 | |
resolv: Support an exactly sized buffer in ns_name_pack [BZ #21359]
This bug did not affect name resolution because those functions
indirectly call ns_name_pack with a buffer which is always larger
than the generated query packet, even in the case of the
longest-possible domain name.
Diffstat (limited to 'resolv/ns_name.c')
| -rw-r--r-- | resolv/ns_name.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/resolv/ns_name.c b/resolv/ns_name.c index 0d76fe5..08a75e2 100644 --- a/resolv/ns_name.c +++ b/resolv/ns_name.c @@ -475,7 +475,7 @@ ns_name_pack(const u_char *src, u_char *dst, int dstsiz, goto cleanup; } n = labellen(srcp); - if (dstp + 1 + n >= eob) { + if (n + 1 > eob - dstp) { goto cleanup; } memcpy(dstp, srcp, n + 1); |