From: Jeff Law <law@redhat.com>
Date: Wed, 29 Feb 2012 16:51:27 +0000 (-0500)
Subject: [network] Avoid out ouf bounds read in __libc_res_nquerydomain
X-Git-Tag: glibc-2.16-tps~913
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8fdceb2efda8cf724cfc4444af86b5f135ad3172;p=thirdparty%2Fglibc.git

[network] Avoid out ouf bounds read in __libc_res_nquerydomain

2012-02-28  Jeff Law  <law@redhat.com>

	* resolv/res_query.c (__libc_res_nquerydomain): Avoid
	out of bounds read.
---

diff --git a/ChangeLog b/ChangeLog
index 069bbc3e0f0..5501ffb4c44 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2012-02-29  Jeff Law  <law@redhat.com>
+
+	* resolv/res_query.c (__libc_res_nquerydomain): Avoid
+	out of bounds read.
+
 2012-02-29  Marek Polacek  <polacek@redhat.com>
 
 	[BZ #13706]
diff --git a/resolv/res_query.c b/resolv/res_query.c
index 947c6513a2b..abccd4a9210 100644
--- a/resolv/res_query.c
+++ b/resolv/res_query.c
@@ -556,12 +556,16 @@ __libc_res_nquerydomain(res_state statp,
 		 * copy without '.' if present.
 		 */
 		n = strlen(name);
-		if (n >= MAXDNAME) {
+
+		/* Decrement N prior to checking it against MAXDNAME
+		   so that we detect a wrap to SIZE_MAX and return
+		   a reasonable error.  */
+		n--;
+		if (n >= MAXDNAME - 1) {
 			RES_SET_H_ERRNO(statp, NO_RECOVERY);
 			return (-1);
 		}
-		n--;
-		if (n >= 0 && name[n] == '.') {
+		if (name[n] == '.') {
 			strncpy(nbuf, name, n);
 			nbuf[n] = '\0';
 		} else