Module Name: src
Committed By: christos
Date: Fri Mar 7 01:00:58 UTC 2014
Modified Files:
src/lib/libc/nameser: ns_name.c
Log Message:
Fix incorrect overflow test: https://android-review.googlesource.com/#/c/50570/
To generate a diff of this commit:
cvs rdiff -u -r1.9 -r1.10 src/lib/libc/nameser/ns_name.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/lib/libc/nameser/ns_name.c
diff -u src/lib/libc/nameser/ns_name.c:1.9 src/lib/libc/nameser/ns_name.c:1.10
--- src/lib/libc/nameser/ns_name.c:1.9 Tue Mar 13 17:13:39 2012
+++ src/lib/libc/nameser/ns_name.c Thu Mar 6 20:00:58 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: ns_name.c,v 1.9 2012/03/13 21:13:39 christos Exp $ */
+/* $NetBSD: ns_name.c,v 1.10 2014/03/07 01:00:58 christos Exp $ */
/*
* Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
@@ -22,7 +22,7 @@
#ifdef notdef
static const char rcsid[] = "Id: ns_name.c,v 1.11 2009/01/23 19:59:16 each Exp";
#else
-__RCSID("$NetBSD: ns_name.c,v 1.9 2012/03/13 21:13:39 christos Exp $");
+__RCSID("$NetBSD: ns_name.c,v 1.10 2014/03/07 01:00:58 christos Exp $");
#endif
#endif
@@ -473,11 +473,12 @@ ns_name_unpack2(const u_char *msg, const
_DIAGASSERT(__type_fit(int, srcp - src + 1));
len = (int)(srcp - src + 1);
}
- srcp = msg + (((n & 0x3f) << 8) | (*srcp & 0xff));
- if (srcp < msg || srcp >= eom) { /*%< Out of range. */
+ l = ((n & 0x3f) << 8) | (*srcp & 0xff);
+ if (l >= eom - msg) { /*%< Out of range. */
errno = EMSGSIZE;
return (-1);
}
+ srcp = msg + l;
checked += 2;
/*
* Check for loops in the compressed name;
