diff options
| author | Jeff Law <law@redhat.com> | 2012-02-29 11:51:27 -0500 |
|---|---|---|
| committer | Carlos O'Donell <carlos@codesourcery.com> | 2012-02-29 11:51:27 -0500 |
| commit | 8fdceb2efda8cf724cfc4444af86b5f135ad3172 (patch) | |
| tree | 82fca394d283dbc256d979675977ee3418ddbed3 /resolv/res_query.c | |
| parent | 1f393a11f65dcaa1952bdcaf0317a65a5f8aff9d (diff) | |
| download | glibc-8fdceb2efda8cf724cfc4444af86b5f135ad3172.zip glibc-8fdceb2efda8cf724cfc4444af86b5f135ad3172.tar.gz glibc-8fdceb2efda8cf724cfc4444af86b5f135ad3172.tar.bz2 | |
[network] Avoid out ouf bounds read in __libc_res_nquerydomain
2012-02-28 Jeff Law <law@redhat.com>
* resolv/res_query.c (__libc_res_nquerydomain): Avoid
out of bounds read.
Diffstat (limited to 'resolv/res_query.c')
| -rw-r--r-- | resolv/res_query.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/resolv/res_query.c b/resolv/res_query.c index 947c651..abccd4a 100644 --- a/resolv/res_query.c +++ b/resolv/res_query.c @@ -556,12 +556,16 @@ __libc_res_nquerydomain(res_state statp, * copy without '.' if present. */ n = strlen(name); - if (n >= MAXDNAME) { + + /* Decrement N prior to checking it against MAXDNAME + so that we detect a wrap to SIZE_MAX and return + a reasonable error. */ + n--; + if (n >= MAXDNAME - 1) { RES_SET_H_ERRNO(statp, NO_RECOVERY); return (-1); } - n--; - if (n >= 0 && name[n] == '.') { + if (name[n] == '.') { strncpy(nbuf, name, n); nbuf[n] = '\0'; } else |