* Fix buffer overflow in fget_token and bget_token.

diff --git a/Changelog b/Changelog
index b07a489cba696edd9b7a8baa2346205a9ed2eef7..5b969845ed1959b636f9b8e68a38ec4033bc41ac 100644 (file)
--- a/Changelog
+++ b/Changelog
@@ -30,6 +30,7 @@
          dictionary.  Patch from shussain.
        * bugfix #517: ldns_resolver_new_frm_fp error when invoked using a NULL
          file pointer.
+       * Fix buffer overflow in fget_token and bget_token.
 
 1.6.16 2012-11-13
        * Fix Makefile to build pyldns with BSD make

diff --git a/parse.c b/parse.c
index 8849effad6ffaad712583cb7b15cd866acd94557..710c4e70b8489df4b52f341601bd766d76317be9 100644 (file)
--- a/parse.c
+++ b/parse.c
@@ -135,7 +135,7 @@ ldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *li
                if (c != '\0' && c != '\n') {
                        i++;
                }
-               if (limit > 0 && i >= limit) {
+               if (limit > 0 && (i >= limit || (size_t)(t-token) >= limit)) {
                        *t = '\0';
                        return -1;
                }
@@ -308,7 +308,7 @@ ldns_bget_token(ldns_buffer *b, char *token, const char *delim, size_t limit)
                }
 
                i++;
-               if (limit > 0 && i >= limit) {
+               if (limit > 0 && (i >= limit || (size_t)(t-token) >= limit)) {
                        *t = '\0';
                        return -1;
                }