Potential stack overflow in ares_set_sortlist

[hopper-vul]

In ares_set_sortlist, it calls config_sortlist(..., sortstr) to parse
the input str and initialize a sortlist configuration.

However, ares_set_sortlist has not any checks about the validity of the input str.
It is very easy to create an arbitrary length stack overflow with the unchecked
memcpy(ipbuf, str, q-str); and memcpy(ipbufpfx, str, q-str);
statements in the config_sortlist call, which could potentially cause severe
security impact in practical programs.

For example, the litter case could produce a stack overflow:

#include "ares.h"
#include<stdlib.h>
typedef int8_t  i8;
typedef int32_t i32;
int main() {
    struct ares_channeldata *v0 = NULL; // channel
    i32 v2 = ares_init(&v0); // $relative
    i8 v5[] = "111.111.111.111*shellcode*shellcode*shellcode*/"; // sortstr
    i32 v6 = ares_set_sortlist(v0, v5); // $target
}

As ares_set_sortlist is a public interface of a widely-used library,
i think it is necessary to add some checks to forbid further severe security bugs.

[00xc]

This got assigned CVE-2022-4904 by Red Hat CNA.