Module Name: src
Committed By: christos
Date: Wed Sep 4 12:14:09 UTC 2019
Modified Files:
src/lib/libc/nameser: ns_name.c
Log Message:
Since we advance cp after the bounds check, we need to test for bounds
again before using it. Discovered via fuzzing, reported by enh at google, via:
https://android-review.googlesource.com/c/platform/bionic/+/1093130
To generate a diff of this commit:
cvs rdiff -u -r1.11 -r1.12 src/lib/libc/nameser/ns_name.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/lib/libc/nameser/ns_name.c
diff -u src/lib/libc/nameser/ns_name.c:1.11 src/lib/libc/nameser/ns_name.c:1.12
--- src/lib/libc/nameser/ns_name.c:1.11 Thu Mar 6 20:07:01 2014
+++ src/lib/libc/nameser/ns_name.c Wed Sep 4 08:14:09 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: ns_name.c,v 1.11 2014/03/07 01:07:01 christos Exp $ */
+/* $NetBSD: ns_name.c,v 1.12 2019/09/04 12:14:09 christos Exp $ */
/*
* Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
@@ -22,7 +22,7 @@
#ifdef notdef
static const char rcsid[] = "Id: ns_name.c,v 1.11 2009/01/23 19:59:16 each Exp";
#else
-__RCSID("$NetBSD: ns_name.c,v 1.11 2014/03/07 01:07:01 christos Exp $");
+__RCSID("$NetBSD: ns_name.c,v 1.12 2019/09/04 12:14:09 christos Exp $");
#endif
#endif
@@ -696,7 +696,7 @@ ns_name_skip(const u_char **ptrptr, cons
{
const u_char *cp;
u_int n;
- int l;
+ int l = 0;
cp = *ptrptr;
while (cp < eom && (n = *cp++) != 0) {
@@ -706,7 +706,7 @@ ns_name_skip(const u_char **ptrptr, cons
cp += n;
continue;
case NS_TYPE_ELT: /*%< EDNS0 extended label */
- if ((l = labellen(cp - 1)) < 0) {
+ if (cp < eom && (l = labellen(cp - 1)) < 0) {
errno = EMSGSIZE; /*%< XXX */
return (-1);
}
