hesiod: Avoid heap overflow in get_txt_records [BZ #20031]
This commit is contained in:
parent
5018f16c62
commit
8a03ccbb77
|
@ -1,3 +1,9 @@
|
||||||
|
2016-05-02 Florian Weimer <fweimer@redhat.com>
|
||||||
|
|
||||||
|
[BZ #20031]
|
||||||
|
* hesiod/hesiod.c (get_txt_records): Return error if TXT record is
|
||||||
|
completely empty.
|
||||||
|
|
||||||
2016-05-02 Florian Weimer <fweimer@redhat.com>
|
2016-05-02 Florian Weimer <fweimer@redhat.com>
|
||||||
|
|
||||||
[BZ #19573]
|
[BZ #19573]
|
||||||
|
|
|
@ -398,7 +398,7 @@ get_txt_records(struct hesiod_p *ctx, int class, const char *name) {
|
||||||
cp += INT16SZ + INT32SZ; /* skip the ttl, too */
|
cp += INT16SZ + INT32SZ; /* skip the ttl, too */
|
||||||
rr.dlen = ns_get16(cp);
|
rr.dlen = ns_get16(cp);
|
||||||
cp += INT16SZ;
|
cp += INT16SZ;
|
||||||
if (cp + rr.dlen > eom) {
|
if (rr.dlen == 0 || cp + rr.dlen > eom) {
|
||||||
__set_errno(EMSGSIZE);
|
__set_errno(EMSGSIZE);
|
||||||
goto cleanup;
|
goto cleanup;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue