mirror of
https://github.com/isc-projects/bind9.git
synced 2026-05-23 02:28:55 -04:00
isc_buffer_init() is given MAX_DNS_MESSAGE_SIZE (65535) as capacity but only h2->content_length bytes are allocated. This makes the buffer believe it has more space than actually allocated. A secondary bounds check (new_bufsize <= h2->content_length) prevents actual overflow, but the buffer invariant is violated. Pass h2->content_length as the capacity to match the allocation. |
||
|---|---|---|
| .. | ||
| dns | ||
| isc | ||
| isccc | ||
| isccfg | ||
| ns | ||
| .gitignore | ||
| meson.build | ||