upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-20 23:00:56 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- Fix out-of-bounds null-byte write in sldns_bget_token_par while

Browse source 
parsing type WKS, reported by Luis Merino from X41 D-Sec.
This commit is contained in:
W.C.A. Wijngaards 2020-01-08 11:08:16 +01:00
parent 19473d95eb
commit 05a5dc2d0d
2 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
doc/Changelog
View file

@ -1,5 +1,7 @@
8 January 2020: Wouter
- Fix 'make test' to work for --disable-sha1 configure option.
- Fix out-of-bounds null-byte write in sldns_bget_token_par while
parsing type WKS, reported by Luis Merino from X41 D-Sec.
6 January 2020: George
- Downgrade compat/getentropy_solaris.c to version 1.4 from OpenBSD.

8
sldns/parse.c
View file

@ -120,7 +120,7 @@ sldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *l
if (line_nr) {
*line_nr = *line_nr + 1;
}
if (limit > 0 && (i >= limit || (size_t)(t-token) >= limit)) {
if (limit > 0 && (i > limit || (size_t)(t-token) > limit)) {
*t = '\0';
return -1;
}
@ -141,7 +141,7 @@ sldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *l
if (c != '\0' && c != '\n') {
i++;
}
if (limit > 0 && (i >= limit || (size_t)(t-token) >= limit)) {
if (limit > 0 && (i > limit || (size_t)(t-token) > limit)) {
*t = '\0';
return -1;
}
@ -327,7 +327,7 @@ sldns_bget_token_par(sldns_buffer *b, char *token, const char *delim,
/* do not write ' ' if we want to skip spaces */
if(!(skipw && (strchr(skipw, c)||strchr(skipw, ' ')))) {
/* check for space for the space character */
if (limit > 0 && (i >= limit || (size_t)(t-token) >= limit)) {
if (limit > 0 && (i > limit || (size_t)(t-token) > limit)) {
*t = '\0';
return -1;
}
@ -354,7 +354,7 @@ sldns_bget_token_par(sldns_buffer *b, char *token, const char *delim,
}
i++;
if (limit > 0 && (i >= limit || (size_t)(t-token) >= limit)) {
if (limit > 0 && (i > limit || (size_t)(t-token) > limit)) {
*t = '\0';
return -1;
}