Module Name: src Committed By: christos Date: Fri Mar 7 01:06:07 UTC 2014
Modified Files: src/external/bsd/libbind/dist/nameser: ns_name.c Log Message: fix incorrect overflow test: https://android-review.googlesource.com/#/c/50570/ To generate a diff of this commit: cvs rdiff -u -r1.1.1.2 -r1.2 src/external/bsd/libbind/dist/nameser/ns_name.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/external/bsd/libbind/dist/nameser/ns_name.c diff -u src/external/bsd/libbind/dist/nameser/ns_name.c:1.1.1.2 src/external/bsd/libbind/dist/nameser/ns_name.c:1.2 --- src/external/bsd/libbind/dist/nameser/ns_name.c:1.1.1.2 Sun Sep 9 12:08:04 2012 +++ src/external/bsd/libbind/dist/nameser/ns_name.c Thu Mar 6 20:06:07 2014 @@ -1,4 +1,4 @@ -/* $NetBSD: ns_name.c,v 1.1.1.2 2012/09/09 16:08:04 christos Exp $ */ +/* $NetBSD: ns_name.c,v 1.2 2014/03/07 01:06:07 christos Exp $ */ /* * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC") @@ -463,11 +463,13 @@ ns_name_unpack2(const u_char *msg, const } if (len < 0) len = srcp - src + 1; - srcp = msg + (((n & 0x3f) << 8) | (*srcp & 0xff)); - if (srcp < msg || srcp >= eom) { /*%< Out of range. */ + + n = ((n & 0x3f) << 8) | (*srcp & 0xff); + if (n >= eom - msg) { /*%< Out of range. */ errno = EMSGSIZE; return (-1); } + srcp = msg + n; checked += 2; /* * Check for loops in the compressed name;