- Fix Out of Bounds Write in sldns_str2wire_str_buf(),

  reported by X41 D-Sec.

diff --git a/doc/Changelog b/doc/Changelog
index aabdcec2550202388bd72dcecb265628ae251034..5c4cb3eb10e3341b7616d75662303b45d34502d7 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -10,6 +10,8 @@
          reported by X41 D-Sec.
        - Fix OOB Read in sldns_wire2str_dname_scan(),
          reported by X41 D-Sec.
+       - Fix Out of Bounds Write in sldns_str2wire_str_buf(),
+         reported by X41 D-Sec.
 
 2 December 2019: Wouter
        - Merge pull request #122 from he32: In tcp_callback_writer(),

diff --git a/sldns/str2wire.c b/sldns/str2wire.c
index 705cbc286bc5527709bcaebdd779efb45fed8fe3..eea9a38b8b8433400a021c20c3acd3aa83c93e2c 100644 (file)
--- a/sldns/str2wire.c
+++ b/sldns/str2wire.c
@@ -1103,7 +1103,7 @@ int sldns_str2wire_str_buf(const char* str, uint8_t* rd, size_t* len)
        while(sldns_parse_char(&ch, &s)) {
                if(sl >= 255)
                        return RET_ERR(LDNS_WIREPARSE_ERR_INVALID_STR, s-str);
-               if(*len < sl+1)
+               if(*len < sl+2)
                        return RET_ERR(LDNS_WIREPARSE_ERR_BUFFER_TOO_SMALL,
                                s-str);
                rd[++sl] = ch;