aboutsummaryrefslogtreecommitdiffstats
path: root/lib/libc/net/name6.c
diff options
context:
space:
mode:
authorTrevor Johnson <trevor@FreeBSD.org>2002-07-10 06:57:44 +0000
committerTrevor Johnson <trevor@FreeBSD.org>2002-07-10 06:57:44 +0000
commit7f484866a20db7df608d7cfa9ab8e8bc089a5de8 (patch)
tree2858702d2f7d2e723a783d00f63ac2a2cae6f41a /lib/libc/net/name6.c
parent2a86dbea9c07a9c9b263025146cf294248a2a21a (diff)
downloadsrc-7f484866a20db7df608d7cfa9ab8e8bc089a5de8.tar.gz
src-7f484866a20db7df608d7cfa9ab8e8bc089a5de8.zip
MFC: fix buffer overflows described in FreeBSD-SA-02:28.resolv.
Reviewed by: imp
Notes
Notes: svn path=/releng/4.3/; revision=99716
Diffstat (limited to 'lib/libc/net/name6.c')
-rw-r--r--lib/libc/net/name6.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/libc/net/name6.c b/lib/libc/net/name6.c
index 8edcb1bee858..401786811b50 100644
--- a/lib/libc/net/name6.c
+++ b/lib/libc/net/name6.c
@@ -1024,7 +1024,7 @@ getanswer(answer, anslen, qname, qtype, template, errp)
register const u_char *cp;
register int n;
const u_char *eom, *erdata;
- char *bp, **ap, **hap;
+ char *bp, **ap, **hap, *obp;
int type, class, buflen, ancount, qdcount;
int haveanswer, had_error;
char tbuf[MAXDNAME];
@@ -1238,7 +1238,9 @@ getanswer(answer, anslen, qname, qtype, template, errp)
bp += nn;
buflen -= nn;
}
+ obp = bp; /* ALIGN rounds up */
bp = (char *)ALIGN(bp);
+ buflen -= (bp - obp);
DNS_FATAL(bp + n < &hostbuf[sizeof hostbuf]);
DNS_ASSERT(hap < &h_addr_ptrs[MAXADDRS-1]);