mirror of
https://github.com/isc-projects/bind9.git
synced 2026-05-28 04:34:54 -04:00
isc_buffer_init() is given MAX_DNS_MESSAGE_SIZE (65535) as capacity but
only h2->content_length bytes are allocated. This makes the buffer
believe it has more space than actually allocated. A secondary bounds
check (new_bufsize <= h2->content_length) prevents actual overflow, but
the buffer invariant is violated.
Pass h2->content_length as the capacity to match the allocation.
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| http.c | ||
| netmgr-int.h | ||
| netmgr.c | ||
| proxystream.c | ||
| proxyudp.c | ||
| socket.c | ||
| streamdns.c | ||
| tcp.c | ||
| timer.c | ||
| tlsstream.c | ||
| udp.c | ||