commit d0494b368e56a2bc102aaac9d5c3afa748a9462a
author Treehugger Robot <treehugger-gerrit@google.com> Wed Sep 04 02:21:43 2019 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Wed Sep 04 02:21:43 2019 +0000
tree 0402c413bf59a409292d06515c3f88c368b75d0a
parent 2fb9a03b9cfcb6dffdf0c4728bb8947509e083c6
parent 2cc76462e586fde49145300d0602a208b69b5c23

Merge "Test for ns_parserr() and got a heap-buffer-overflow"

libc/dns/nameser/ns_name.c

diff --git a/libc/dns/nameser/ns_name.c b/libc/dns/nameser/ns_name.c
index 3a202c1..c2dc80f 100644
--- a/libc/dns/nameser/ns_name.c
+++ b/libc/dns/nameser/ns_name.c
@@ -692,7 +692,7 @@
 {
 	const u_char *cp;
 	u_int n;
-	int l;
+	int l=0;
 
 	cp = *ptrptr;
 	while (cp < eom && (n = *cp++) != 0) {
@@ -702,7 +702,7 @@
 			cp += n;
 			continue;
 		case NS_TYPE_ELT: /* EDNS0 extended label */
-			if ((l = labellen(cp - 1)) < 0) {
+			if (cp < eom && (l = labellen(cp - 1)) < 0) {
 				errno = EMSGSIZE; /* XXX */
 				return(-1);
 			}