Contents of /trunk/glibc/patches/glibc-2.15-__libc_res_nquerydomain-out-of-bounds.patch
Parent Directory | Revision Log
Revision 1806 -
(show annotations)
(download)
Tue Jun 12 12:33:27 2012 UTC (12 years, 3 months ago) by niro
File size: 641 byte(s)
Tue Jun 12 12:33:27 2012 UTC (12 years, 3 months ago) by niro
File size: 641 byte(s)
-added patches for 2.15-r1
1 | diff --git a/resolv/res_query.c b/resolv/res_query.c |
2 | index 947c651..abccd4a 100644 |
3 | --- a/resolv/res_query.c |
4 | +++ b/resolv/res_query.c |
5 | @@ -556,12 +556,16 @@ __libc_res_nquerydomain(res_state statp, |
6 | * copy without '.' if present. |
7 | */ |
8 | n = strlen(name); |
9 | - if (n >= MAXDNAME) { |
10 | + |
11 | + /* Decrement N prior to checking it against MAXDNAME |
12 | + so that we detect a wrap to SIZE_MAX and return |
13 | + a reasonable error. */ |
14 | + n--; |
15 | + if (n >= MAXDNAME - 1) { |
16 | RES_SET_H_ERRNO(statp, NO_RECOVERY); |
17 | return (-1); |
18 | } |
19 | - n--; |
20 | - if (n >= 0 && name[n] == '.') { |
21 | + if (name[n] == '.') { |
22 | strncpy(nbuf, name, n); |
23 | nbuf[n] = '\0'; |
24 | } else |