diff options
| author | Florian Weimer <fweimer@redhat.com> | 2016-04-27 15:11:41 +0200 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2016-04-27 15:11:42 +0200 |
| commit | f749498fa53df9ead81e291cd9378d67483c2452 (patch) | |
| tree | 6d4153c36df6d2a75e43ea51584f3664b5695ac8 /resolv/nss_dns/dns-host.c | |
| parent | b9bdfa7c8fa22c944bb5f21a673dfd1f91b71c56 (diff) | |
| download | glibc-f749498fa53df9ead81e291cd9378d67483c2452.tar.gz glibc-f749498fa53df9ead81e291cd9378d67483c2452.tar.xz glibc-f749498fa53df9ead81e291cd9378d67483c2452.zip | |
nss_dns: Validate RDATA length against packet length [BZ #19830]
In _nss_dns_getcanonname_r, a check for the availability of RR metadata was missing as well.
Diffstat (limited to 'resolv/nss_dns/dns-host.c')
| -rw-r--r-- | resolv/nss_dns/dns-host.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/resolv/nss_dns/dns-host.c b/resolv/nss_dns/dns-host.c index 8599f4c6a6..4bb0e6268a 100644 --- a/resolv/nss_dns/dns-host.c +++ b/resolv/nss_dns/dns-host.c @@ -751,6 +751,14 @@ getanswer_r (const querybuf *answer, int anslen, const char *qname, int qtype, cp += INT32SZ; /* TTL */ n = __ns_get16 (cp); cp += INT16SZ; /* len */ + + if (end_of_message - cp < n) + { + /* RDATA extends beyond the end of the packet. */ + ++had_error; + continue; + } + if (__glibc_unlikely (class != C_IN)) { /* XXX - debug? syslog? */ @@ -1077,6 +1085,13 @@ gaih_getanswer_slice (const querybuf *answer, int anslen, const char *qname, n = __ns_get16 (cp); cp += INT16SZ; /* len */ + if (end_of_message - cp < n) + { + /* RDATA extends beyond the end of the packet. */ + ++had_error; + continue; + } + if (class != C_IN) { cp += n; |