lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-07-30 22:43:12 +03:00
Code Activity

2002-11-14 Paul Eggert <eggert@twionsun.com>

Browse Source 
* resolv/nss_dns/dns-network.c (getanswer_r): Check for buffer
        overflow when skipping the question part and when unpacking
        aliases.
This commit is contained in:
Roland McGrath
2002-11-18 04:10:15 +00:00
parent 502328b258
commit 9b57c1c1e4
2 changed files with 24 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -1,3 +1,9 @@
2002-11-14 Paul Eggert <eggert@twionsun.com>
* resolv/nss_dns/dns-network.c (getanswer_r): Check for buffer
overflow when skipping the question part and when unpacking
aliases.
2002-11-15 Roland McGrath <roland@redhat.com> 2002-11-15 Roland McGrath <roland@redhat.com>
* math/Makefile (libm-calls): Remove s_copysign, s_isinf, s_isnan, * math/Makefile (libm-calls): Remove s_copysign, s_isinf, s_isnan,

13
resolv/nss_dns/dns-network.c
View File

@ -283,7 +283,15 @@ getanswer_r (const querybuf *answer, int anslen, struct netent *result,
/* Skip the question part. */ /* Skip the question part. */
while (question_count-- > 0) while (question_count-- > 0)
cp += __dn_skipname (cp, end_of_message) + QFIXEDSZ; {
int n = __dn_skipname (cp, end_of_message);
if (n < 0 || end_of_message - (cp + n) < QFIXEDSZ)
{
__set_h_errno (NO_RECOVERY);
return NSS_STATUS_UNAVAIL;
}
cp += n + QFIXEDSZ;
}
alias_pointer = result->n_aliases = &net_data->aliases[0]; alias_pointer = result->n_aliases = &net_data->aliases[0];
*alias_pointer = NULL; *alias_pointer = NULL;
@ -344,6 +352,8 @@ getanswer_r (const querybuf *answer, int anslen, struct netent *result,
return NSS_STATUS_UNAVAIL; return NSS_STATUS_UNAVAIL;
} }
cp += n; cp += n;
if (alias_pointer + 2 < &net_data->aliases[MAX_NR_ALIASES])
{
*alias_pointer++ = bp; *alias_pointer++ = bp;
n = strlen (bp) + 1; n = strlen (bp) + 1;
bp += n; bp += n;
@ -352,6 +362,7 @@ getanswer_r (const querybuf *answer, int anslen, struct netent *result,
++have_answer; ++have_answer;
} }
} }
}
if (have_answer) if (have_answer)
{ {