summaryrefslogtreecommitdiff
path: root/rr.c
diff options
context:
space:
mode:
authorWillem Toorop <willem@NLnetLabs.nl>2011-08-24 22:04:48 +0200
committerWillem Toorop <willem@NLnetLabs.nl>2011-08-24 22:04:48 +0200
commit637072dd8a4118bfedfaaf0f8ab6b1ed53301d88 (patch)
tree9e32d46b37f5f0c95b56950770e9f4d401a12637 /rr.c
parent1a3831cf6878b335052bb809fcca6623792e4f83 (diff)
downloadldns-637072dd8a4118bfedfaaf0f8ab6b1ed53301d88.tar.gz
Fix heap overflow problem thanks to david keeler: bug #403
Diffstat (limited to 'rr.c')
-rw-r--r--rr.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/rr.c b/rr.c
index 464a62c8..bfdcf0ba 100644
--- a/rr.c
+++ b/rr.c
@@ -431,7 +431,10 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
cur_hex_data_size = 0;
while(cur_hex_data_size < 2 * hex_data_size) {
c = ldns_bget_token(rd_buf, rd, delimiters, LDNS_MAX_RDFLEN);
- if (c == -1) {
+ if (c != -1) {
+ rd_strlen = strlen(rd);
+ }
+ if (c == -1 || cur_hex_data_size + rd_strlen > 2 * hex_data_size) {
LDNS_FREE(hex_data_str);
LDNS_FREE(rd);
LDNS_FREE(b64);
@@ -441,7 +444,6 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
ldns_rr_free(new);
return LDNS_STATUS_SYNTAX_RDATA_ERR;
}
- rd_strlen = strlen(rd);
strncpy(hex_data_str + cur_hex_data_size, rd, rd_strlen);
cur_hex_data_size += rd_strlen;
}