From adbace93400f7eef30c964c337766eab2c914178 Mon Sep 17 00:00:00 2001 From: Remi Gacogne Date: Fri, 27 Nov 2015 15:06:32 +0100 Subject: [PATCH] Check that offset < len in DNSName constructor Otherwise, we might call memchr() with garbage, as len and offset are signed but memchr()'s n is unsigned (size_t). --- pdns/dnsname.cc | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pdns/dnsname.cc b/pdns/dnsname.cc index 8bee721a8..9aed6e1f4 100644 --- a/pdns/dnsname.cc +++ b/pdns/dnsname.cc @@ -32,6 +32,9 @@ DNSName::DNSName(const char* p) DNSName::DNSName(const char* pos, int len, int offset, bool uncompress, uint16_t* qtype, uint16_t* qclass, unsigned int* consumed) { + if (offset >= len) + throw std::range_error("Trying to read past the end of the buffer"); + if(!uncompress) { if(const void * fnd=memchr(pos+offset, 0, len-offset)) { d_storage.reserve(2+(const char*)fnd-(pos+offset)); -- 2.40.0