- Fix Out of Bound Write Compressed Names in rdata_copy(),

  reported by X41 D-Sec.

diff --git a/doc/Changelog b/doc/Changelog
index bceb443e3ca233caabbaaadb4abf34b2ea79052c..7e592710c1b0fef21ac786c49bb7589b36c4a0f1 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -17,6 +17,8 @@
          reported by X41 D-Sec.
        - Fix Insufficient Handling of Compressed Names in dname_pkt_copy(),
          reported by X41 D-Sec.
+       - Fix Out of Bound Write Compressed Names in rdata_copy(),
+         reported by X41 D-Sec.
 
 2 December 2019: Wouter
        - Merge pull request #122 from he32: In tcp_callback_writer(),

diff --git a/util/data/msgreply.c b/util/data/msgreply.c
index a2c09ac2016bf847d484fdc131de9ce86628c3a0..4320f312d6f3def44fb71f047a43d19924473b67 100644 (file)
--- a/util/data/msgreply.c
+++ b/util/data/msgreply.c
@@ -243,10 +243,10 @@ rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to,
                                break;
                        }
                        if(len) {
+                               log_assert(len <= pkt_len);
                                memmove(to, sldns_buffer_current(pkt), len);
                                to += len;
                                sldns_buffer_skip(pkt, (ssize_t)len);
-                               log_assert(len <= pkt_len);
                                pkt_len -= len;
                        }
                        rdf++;