summaryrefslogtreecommitdiff
path: root/multilib-testing/lib32-glibc/glibc-2.15-__libc_res_nquerydomain-out-of-bounds.patch
blob: 6f0a0398f4483ceae85ae680b57e4ee47188ced7 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
diff --git a/resolv/res_query.c b/resolv/res_query.c
index 947c651..abccd4a 100644
--- a/resolv/res_query.c
+++ b/resolv/res_query.c
@@ -556,12 +556,16 @@ __libc_res_nquerydomain(res_state statp,
 		 * copy without '.' if present.
 		 */
 		n = strlen(name);
-		if (n >= MAXDNAME) {
+
+		/* Decrement N prior to checking it against MAXDNAME
+		   so that we detect a wrap to SIZE_MAX and return
+		   a reasonable error.  */
+		n--;
+		if (n >= MAXDNAME - 1) {
 			RES_SET_H_ERRNO(statp, NO_RECOVERY);
 			return (-1);
 		}
-		n--;
-		if (n >= 0 && name[n] == '.') {
+		if (name[n] == '.') {
 			strncpy(nbuf, name, n);
 			nbuf[n] = '\0';
 		} else