PKGBUILDs/core/glibc/glibc-2.15-__libc_res_nquerydomain-out-of-bounds.patch
2012-03-15 20:19:20 -04:00

24 lines
650 B
Diff

diff --git a/resolv/res_query.c b/resolv/res_query.c
index 947c651..abccd4a 100644
--- a/resolv/res_query.c
+++ b/resolv/res_query.c
@@ -556,12 +556,16 @@ __libc_res_nquerydomain(res_state statp,
* copy without '.' if present.
*/
n = strlen(name);
- if (n >= MAXDNAME) {
+
+ /* Decrement N prior to checking it against MAXDNAME
+ so that we detect a wrap to SIZE_MAX and return
+ a reasonable error. */
+ n--;
+ if (n >= MAXDNAME - 1) {
RES_SET_H_ERRNO(statp, NO_RECOVERY);
return (-1);
}
- n--;
- if (n >= 0 && name[n] == '.') {
+ if (name[n] == '.') {
strncpy(nbuf, name, n);
nbuf[n] = '\0';
} else