Justin's items 1 and 2.

diff --git a/compat/b32_ntop.c b/compat/b32_ntop.c
index 6f534cc8aee6af996622955040fb62c087eb89f0..52f636111dfe281ccced1b6642122b63057b1f7f 100644 (file)
--- a/compat/b32_ntop.c
+++ b/compat/b32_ntop.c
@@ -254,40 +254,55 @@ ldns_b32_ntop_ar(uint8_t const *src, size_t srclength, char *target, size_t targ
                }
                target[datalength++] = B32_ar[output[0]];
                if (srclength >= 1) {
+                       if (datalength + 1 > targsize) { return (-2); }
                        target[datalength++] = B32_ar[output[1]];
                        if (srclength == 1 && output[2] == 0) {
+                               if (datalength + 1 > targsize) { return (-2); }
                                target[datalength++] = Pad32;
                        } else {
+                               if (datalength + 1 > targsize) { return (-2); }
                                target[datalength++] = B32_ar[output[2]];
                        }
                } else {
+                       if (datalength + 1 > targsize) { return (-2); }
                        target[datalength++] = Pad32;
+                       if (datalength + 1 > targsize) { return (-2); }
                        target[datalength++] = Pad32;
                }
                if (srclength >= 2) {
+                       if (datalength + 1 > targsize) { return (-2); }
                        target[datalength++] = B32_ar[output[3]];
                } else {
+                       if (datalength + 1 > targsize) { return (-2); }
                        target[datalength++] = Pad32;
                }
                if (srclength >= 3) {
+                       if (datalength + 1 > targsize) { return (-2); }
                        target[datalength++] = B32_ar[output[4]];
                        if (srclength == 3 && output[5] == 0) {
+                               if (datalength + 1 > targsize) { return (-2); }
                                target[datalength++] = Pad32;
                        } else {
+                               if (datalength + 1 > targsize) { return (-2); }
                                target[datalength++] = B32_ar[output[5]];
                        }
                } else {
+                       if (datalength + 1 > targsize) { return (-2); }
                        target[datalength++] = Pad32;
+                       if (datalength + 1 > targsize) { return (-2); }
                        target[datalength++] = Pad32;
                }
                if (srclength >= 4) {
+                       if (datalength + 1 > targsize) { return (-2); }
                        target[datalength++] = B32_ar[output[6]];
                } else {
+                       if (datalength + 1 > targsize) { return (-2); }
                        target[datalength++] = Pad32;
                }
+               if (datalength + 1 > targsize) { return (-2); }
                target[datalength++] = Pad32;
        }
-       if (datalength > targsize) {
+       if (datalength+1 > targsize) {
                return (-3);
        }
        target[datalength] = '\0';      /* Returned value doesn't count \0. */