diff options
| author | Adam <Adam@anope.org> | 2012-03-26 04:59:13 -0400 |
|---|---|---|
| committer | Adam <Adam@anope.org> | 2012-03-26 04:59:13 -0400 |
| commit | ed28c1ba666b39581adb860bf51cdde43c84cc89 (patch) | |
| tree | 8e148ccceb52bca5e69447c48e3b16ef0f8ccbd6 | |
| parent | 7fcda51612c27ecbe7c78a535266d306e285afb0 (diff) | |
Fixed out of bounds memory access from malformed DNS queries that have an invalid length label. Introduced in a6a07de0daa353bcd29056a4535a9c4784c113c8.
| -rw-r--r-- | src/dns.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/dns.cpp b/src/dns.cpp index 2e1c751c4..be74e6aa3 100644 --- a/src/dns.cpp +++ b/src/dns.cpp @@ -760,7 +760,7 @@ DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, unsigned length) else i += header.payload[i] + 1; /* skip length and label */ } } - if (length - i < 10) + if (static_cast<int>(length - i) < 10) return std::make_pair((unsigned char*)NULL,"Incorrectly sized DNS reply"); /* XXX: We actually initialise 'rr' here including its ttl field */ |