generic-library/bionic
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix broken pointer overflow check ns_name_unpack()

Browse Source 
Many compilers may optimize away the overflow check `msg + l < msg',
where `msg' is a pointer and `l' is an integer, because pointer
overflow is undefined behavior in C.

Use a safe precondition test `l >= eom - msg' instead.
Bug: 13219633

Change-Id: I3fca2125834073cc36d7e9c4e586e97842265a59
This commit is contained in:
Calin Juravle 2014-03-06 17:05:49 +00:00
parent fcb502e3ec
commit 85c5202a64
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libc/dns/nameser/ns_name.c
View File

@ -473,11 +473,14 @@ ns_name_unpack2(const u_char *msg, const u_char *eom, const u_char *src,
_DIAGASSERT(__type_fit(int, srcp - src + 1));
len = (int)(srcp - src + 1);
}
srcp = msg + (((n & 0x3f) << 8) | (*srcp & 0xff));
if (srcp < msg || srcp >= eom) { /* Out of range. */
// BEGIN android-changed: safer pointer overflow check
l = (((n & 0x3f) << 8) | (*srcp & 0xff));
if (l >= eom - msg) { /* Out of range. */
errno = EMSGSIZE;
return (-1);
}
srcp = msg + l;
// END android-changed
checked += 2;
/*
* Check for loops in the compressed name;