X-Git-Url: http://git.ipfire.org/?a=blobdiff_plain;f=src%2Fdns%2Frfc1035.cc;fp=src%2Fdns%2Frfc1035.cc;h=2fe8ffd0092fa826c65e6639390aaa9169152f6a;hb=1df2a7226a41c3dfe511aa0913c55031145f7c12;hp=1b0be10abaa5b25f4049a1dc0b5db49372f89509;hpb=63022fd37a4f052d9eb30b7018b32eb46eb1c4fd;p=thirdparty%2Fsquid.git

diff --git a/src/dns/rfc1035.cc b/src/dns/rfc1035.cc
index 1b0be10aba..2fe8ffd009 100644
--- a/src/dns/rfc1035.cc
+++ b/src/dns/rfc1035.cc
@@ -265,14 +265,14 @@ rfc1035NameUnpack(const char *buf, size_t sz, unsigned int *off, unsigned short
                 RFC1035_UNPACK_DEBUG;
                 return 1;
             }
-            memcpy(&s, buf + (*off), sizeof(s));
-            s = ntohs(s);
-            (*off) += sizeof(s);
-            /* Sanity check */
-            if ((*off) > sz) {
+            /* before copying compression offset value, ensure it is inside the buffer */
+            if ((*off) + sizeof(s) > sz) {
                 RFC1035_UNPACK_DEBUG;
                 return 1;
             }
+            memcpy(&s, buf + (*off), sizeof(s));
+            s = ntohs(s);
+            (*off) += sizeof(s);
             ptr = s & 0x3FFF;
             /* Make sure the pointer is inside this message */
             if (ptr >= sz) {