From 8fdceb2efda8cf724cfc4444af86b5f135ad3172 Mon Sep 17 00:00:00 2001 From: Jeff Law Date: Wed, 29 Feb 2012 11:51:27 -0500 Subject: [PATCH] [network] Avoid out ouf bounds read in __libc_res_nquerydomain 2012-02-28 Jeff Law * resolv/res_query.c (__libc_res_nquerydomain): Avoid out of bounds read. --- ChangeLog | 5 +++++ resolv/res_query.c | 10 +++++++--- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 069bbc3e0f..5501ffb4c4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +2012-02-29 Jeff Law + + * resolv/res_query.c (__libc_res_nquerydomain): Avoid + out of bounds read. + 2012-02-29 Marek Polacek [BZ #13706] diff --git a/resolv/res_query.c b/resolv/res_query.c index 947c6513a2..abccd4a921 100644 --- a/resolv/res_query.c +++ b/resolv/res_query.c @@ -556,12 +556,16 @@ __libc_res_nquerydomain(res_state statp, * copy without '.' if present. */ n = strlen(name); - if (n >= MAXDNAME) { + + /* Decrement N prior to checking it against MAXDNAME + so that we detect a wrap to SIZE_MAX and return + a reasonable error. */ + n--; + if (n >= MAXDNAME - 1) { RES_SET_H_ERRNO(statp, NO_RECOVERY); return (-1); } - n--; - if (n >= 0 && name[n] == '.') { + if (name[n] == '.') { strncpy(nbuf, name, n); nbuf[n] = '\0'; } else