26 lines
794 B
Diff
26 lines
794 B
Diff
commit 1b98172b141fe874ad43e679e67506f9b2139043
|
|
Author: lutianxiong <50396812+ltx2018@users.noreply.github.com>
|
|
Date: Fri May 22 20:02:21 2020 +0800
|
|
|
|
avoid read-heap-buffer-overflow (#332)
|
|
|
|
Fix invalid read in ares_parse_soa_reply.c found during fuzzing
|
|
|
|
Fixes Bug: #333
|
|
Fix By: lutianxiong (@ltx2018)
|
|
|
|
diff --git a/ares_parse_soa_reply.c b/ares_parse_soa_reply.c
|
|
index 2a2cac8..7cfaed2 100644
|
|
--- a/ares_parse_soa_reply.c
|
|
+++ b/ares_parse_soa_reply.c
|
|
@@ -69,6 +69,9 @@ ares_parse_soa_reply(const unsigned char *abuf, int alen,
|
|
status = ares__expand_name_for_response(aptr, abuf, alen, &qname, &len);
|
|
if (status != ARES_SUCCESS)
|
|
goto failed_stat;
|
|
+
|
|
+ if (alen <= len + HFIXEDSZ + 1)
|
|
+ goto failed;
|
|
aptr += len;
|
|
|
|
qclass = DNS_QUESTION_TYPE(aptr);
|