Annotation of /trunk/glibc/patches/glibc-2.15-__libc_res_nquerydomain-out-of-bounds.patch
Parent Directory | Revision Log
Revision 1806 -
(hide annotations)
(download)
Tue Jun 12 12:33:27 2012 UTC (12 years ago) by niro
File size: 641 byte(s)
Tue Jun 12 12:33:27 2012 UTC (12 years ago) by niro
File size: 641 byte(s)
-added patches for 2.15-r1
1 | niro | 1806 | diff --git a/resolv/res_query.c b/resolv/res_query.c |
2 | index 947c651..abccd4a 100644 | ||
3 | --- a/resolv/res_query.c | ||
4 | +++ b/resolv/res_query.c | ||
5 | @@ -556,12 +556,16 @@ __libc_res_nquerydomain(res_state statp, | ||
6 | * copy without '.' if present. | ||
7 | */ | ||
8 | n = strlen(name); | ||
9 | - if (n >= MAXDNAME) { | ||
10 | + | ||
11 | + /* Decrement N prior to checking it against MAXDNAME | ||
12 | + so that we detect a wrap to SIZE_MAX and return | ||
13 | + a reasonable error. */ | ||
14 | + n--; | ||
15 | + if (n >= MAXDNAME - 1) { | ||
16 | RES_SET_H_ERRNO(statp, NO_RECOVERY); | ||
17 | return (-1); | ||
18 | } | ||
19 | - n--; | ||
20 | - if (n >= 0 && name[n] == '.') { | ||
21 | + if (name[n] == '.') { | ||
22 | strncpy(nbuf, name, n); | ||
23 | nbuf[n] = '\0'; | ||
24 | } else |