Merge "Fix broken pointer overflow check ns_name_unpack()"
diff --git a/libc/dns/nameser/ns_name.c b/libc/dns/nameser/ns_name.c
index 12bf029..e3759ab 100644
--- a/libc/dns/nameser/ns_name.c
+++ b/libc/dns/nameser/ns_name.c
@@ -473,11 +473,14 @@
_DIAGASSERT(__type_fit(int, srcp - src + 1));
len = (int)(srcp - src + 1);
}
- srcp = msg + (((n & 0x3f) << 8) | (*srcp & 0xff));
- if (srcp < msg || srcp >= eom) { /* Out of range. */
+ // BEGIN android-changed: safer pointer overflow check
+ l = (((n & 0x3f) << 8) | (*srcp & 0xff));
+ if (l >= eom - msg) { /* Out of range. */
errno = EMSGSIZE;
return (-1);
}
+ srcp = msg + l;
+ // END android-changed
checked += 2;
/*
* Check for loops in the compressed name;