From af0468eb365f4cc5bb1cd83aaaf13979e07e2080 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Mon, 3 Jun 2024 13:29:06 +0200 Subject: [PATCH] Fix very long DNS names (>64 bytes) potentially crashing the internal name resolving mechanism, the new limit is 256 bytes with proper boundary checking Signed-off-by: DL6ER --- src/resolve.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/resolve.c b/src/resolve.c index e19543bb..457db27c 100644 --- a/src/resolve.c +++ b/src/resolve.c @@ -449,7 +449,8 @@ static char *__attribute__((malloc)) ngethostbyname(const int sock, struct socka // 3www6google3com -> www.google.com static u_char * __attribute__((malloc)) __attribute__((nonnull(1,2,3))) name_fromDNS(unsigned char *reader, unsigned char *buffer, uint16_t *count) { - unsigned char *name = calloc(MAXHOSTNAMELEN, sizeof(char)); + const size_t MAXNAMELEN = 256; + unsigned char *name = calloc(MAXNAMELEN, sizeof(char)); unsigned int p = 0, jumped = 0; // Initialize count @@ -462,7 +463,7 @@ static u_char * __attribute__((malloc)) __attribute__((nonnull(1,2,3))) name_fro // Instead, each label is preceded by a byte containing its length, and // the name is terminated by a zero-length label representing the root // zone. - while(*reader != 0) + while(*reader != 0 && p < MAXNAMELEN - 2) { if(*reader >= 0xC0) {