diff options
| author |  Adam | 2012-03-26 04:59:13 -0400 |
|---|---|---|
| committer | Adam | 2012-03-26 04:59:13 -0400 |
| commit | ed28c1ba666b39581adb860bf51cdde43c84cc89 (patch) | |
| tree | 8e148ccceb52bca5e69447c48e3b16ef0f8ccbd6 /src/dns.cpp | |
| parent | inspircd.com is no longer our dev blog (diff) | |
| download | inspircd++-ed28c1ba666b39581adb860bf51cdde43c84cc89.tar.gz inspircd++-ed28c1ba666b39581adb860bf51cdde43c84cc89.tar.bz2 inspircd++-ed28c1ba666b39581adb860bf51cdde43c84cc89.zip | |
Fixed out of bounds memory access from malformed DNS queries that have an invalid length label. Introduced in a6a07de0daa353bcd29056a4535a9c4784c113c8.
Diffstat (limited to 'src/dns.cpp')
| -rw-r--r-- | src/dns.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/dns.cpp b/src/dns.cpp index 2e1c751c4..be74e6aa3 100644 --- a/src/dns.cpp +++ b/src/dns.cpp @@ -760,7 +760,7 @@ DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, unsigned length) else i += header.payload[i] + 1; /* skip length and label */ } } - if (length - i < 10) + if (static_cast<int>(length - i) < 10) return std::make_pair((unsigned char*)NULL,"Incorrectly sized DNS reply"); /* XXX: We actually initialise 'rr' here including its ttl field */ |