diff options
| author | Nick Mathewson <nickm@torproject.org> | 2013-12-11 15:15:21 -0500 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2014-04-07 22:56:42 -0400 |
| commit | 6d9c332757c96e691ddeb024bd41035490a505d7 (patch) | |
| tree | 900c15f0cc295ebe2c5dcd382a01024eb26e9a14 | |
| parent | 9dd115d6b59aaa7d2f444efb9d7992e472fbfb0f (diff) | |
| download | tor-6d9c332757c96e691ddeb024bd41035490a505d7.tar.gz tor-6d9c332757c96e691ddeb024bd41035490a505d7.zip | |
Another 10363 instance -- this one in the eventdns.c code
| -rw-r--r-- | changes/bug10363 | 3 | ||||
| -rw-r--r-- | src/ext/eventdns.c | 5 |
2 files changed, 6 insertions, 2 deletions
diff --git a/changes/bug10363 b/changes/bug10363 index a3c9905e36..0cdfd9aeeb 100644 --- a/changes/bug10363 +++ b/changes/bug10363 @@ -6,4 +6,7 @@ - Fix another possibly undefined pointer operations in tor_memmem fallback implementation. Another case of bug #10363; bugfix on 0.1.1.1-alpha. + - Fix another possibly undefined pointer operations in the eventdns + fallback implementation. Another case of bug #10363; bugfix on + 0.1.2.1-alpha. diff --git a/src/ext/eventdns.c b/src/ext/eventdns.c index 66280cccdb..a64c5627b6 100644 --- a/src/ext/eventdns.c +++ b/src/ext/eventdns.c @@ -842,10 +842,11 @@ name_parse(u8 *packet, int length, int *idx, char *name_out, size_t name_out_len } if (label_len > 63) return -1; if (cp != name_out) { - if (cp + 1 >= end) return -1; + if (cp >= name_out + name_out_len - 1) return -1; *cp++ = '.'; } - if (cp + label_len >= end) return -1; + if (label_len > name_out_len || + cp >= name_out + name_out_len - label_len) return -1; memcpy(cp, packet + j, label_len); cp += label_len; j += label_len; |