Skip to content

Commit

Permalink
core: avoid overrun-buffer-arg
Browse files Browse the repository at this point in the history
> Overrunning array ((struct a_rdata *)rr->rdata)->ip of 4 bytes
> by passing it to a function which accesses it at byte offset 15
> using argument len (which evaluates to 16)

(cherry picked from commit 5640f69)
  • Loading branch information
linuxmaniac committed Feb 1, 2017
1 parent 76765a2 commit 42f5515
Showing 1 changed file with 10 additions and 1 deletion.
11 changes: 10 additions & 1 deletion dns_cache.c
Expand Up @@ -2362,6 +2362,7 @@ inline static struct hostent* dns_entry2he(struct dns_hash_entry* e)
int af, len;
struct dns_rr* rr;
unsigned char rr_no;
unsigned char *ip;
ticks_t now;
int i;

Expand Down Expand Up @@ -2389,7 +2390,15 @@ inline static struct hostent* dns_entry2he(struct dns_hash_entry* e)
for(i=0; rr && (i<DNS_HE_MAX_ADDR); i++,
rr=dns_entry_get_rr(e, &rr_no, now)){
p_addr[i]=&address[i*len];
memcpy(p_addr[i], ((struct a_rdata*)rr->rdata)->ip, len);
switch(e->type){
case T_A:
ip = ((struct a_rdata*)rr->rdata)->ip;
break;
case T_AAAA:
ip = ((struct aaaa_rdata*)rr->rdata)->ip6;
break;
}
memcpy(p_addr[i], ip, len);
}
if (i==0){
LM_DBG("no good records found (%d) for %.*s (%d)\n",
Expand Down

0 comments on commit 42f5515

Please sign in to comment.