wire2dname fix

diff --git a/Changelog b/Changelog
index ebaa22ae2414c7b59a503e2992ee93fb2fbee06d..c84ab329883fc68fb7f12010ff390babb6fa83d5 100644 (file)
--- a/Changelog
+++ b/Changelog
@@ -1,6 +1,7 @@
 1.6.6
        * Fix ldns_rr_clone to copy question rrs properly.
        * Fix ldns_sign_zone(_nsec3) to clone the soa for the new zone.
+       * Fix ldns_wire2dname size check from reading 1 byte beyond buffer end.
 
 1.6.5
        * Catch \X where X is a digit as an error.

diff --git a/wire2host.c b/wire2host.c
index 99d289fb9d50ad89cf9feb10cca8167ee60e065d..cac67c50f06a9ee41b459e84cc0fe824a3ba1d0e 100644 (file)
--- a/wire2host.c
+++ b/wire2host.c
@@ -101,7 +101,7 @@ ldns_wire2dname(ldns_rdf **dname, const uint8_t *wire, size_t max, size_t *pos)
                if (label_size > LDNS_MAX_LABELLEN) {
                        return LDNS_STATUS_LABEL_OVERFLOW;
                }
-               if (*pos + label_size > max) {
+               if (*pos + 1 + label_size > max) {
                        return LDNS_STATUS_LABEL_OVERFLOW;
                }