Module Name: src
Committed By: christos
Date: Fri Mar 7 01:06:07 UTC 2014
Modified Files:
src/external/bsd/libbind/dist/nameser: ns_name.c
Log Message:
fix incorrect overflow test: https://android-review.googlesource.com/#/c/50570/
To generate a diff of this commit:
cvs rdiff -u -r1.1.1.2 -r1.2 src/external/bsd/libbind/dist/nameser/ns_name.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/external/bsd/libbind/dist/nameser/ns_name.c
diff -u src/external/bsd/libbind/dist/nameser/ns_name.c:1.1.1.2 src/external/bsd/libbind/dist/nameser/ns_name.c:1.2
--- src/external/bsd/libbind/dist/nameser/ns_name.c:1.1.1.2 Sun Sep 9 12:08:04 2012
+++ src/external/bsd/libbind/dist/nameser/ns_name.c Thu Mar 6 20:06:07 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: ns_name.c,v 1.1.1.2 2012/09/09 16:08:04 christos Exp $ */
+/* $NetBSD: ns_name.c,v 1.2 2014/03/07 01:06:07 christos Exp $ */
/*
* Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
@@ -463,11 +463,13 @@ ns_name_unpack2(const u_char *msg, const
}
if (len < 0)
len = srcp - src + 1;
- srcp = msg + (((n & 0x3f) << 8) | (*srcp & 0xff));
- if (srcp < msg || srcp >= eom) { /*%< Out of range. */
+
+ n = ((n & 0x3f) << 8) | (*srcp & 0xff);
+ if (n >= eom - msg) { /*%< Out of range. */
errno = EMSGSIZE;
return (-1);
}
+ srcp = msg + n;
checked += 2;
/*
* Check for loops in the compressed name;
