From: Wouter Wijngaards <wouter@NLnetLabs.nl>
Date: Thu, 17 Jun 2010 10:02:43 +0000 (+0000)
Subject: wire2dname fix
X-Git-Tag: release-1.6.6~38
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=befc07315251e22d661707ffb41dbb677bb9474c;p=thirdparty%2Fldns.git

wire2dname fix
---

diff --git a/Changelog b/Changelog
index ebaa22ae..c84ab329 100644
--- a/Changelog
+++ b/Changelog
@@ -1,6 +1,7 @@
 1.6.6
 	* Fix ldns_rr_clone to copy question rrs properly.
 	* Fix ldns_sign_zone(_nsec3) to clone the soa for the new zone.
+	* Fix ldns_wire2dname size check from reading 1 byte beyond buffer end.
 
 1.6.5
 	* Catch \X where X is a digit as an error.
diff --git a/wire2host.c b/wire2host.c
index 99d289fb..cac67c50 100644
--- a/wire2host.c
+++ b/wire2host.c
@@ -101,7 +101,7 @@ ldns_wire2dname(ldns_rdf **dname, const uint8_t *wire, size_t max, size_t *pos)
 		if (label_size > LDNS_MAX_LABELLEN) {
 			return LDNS_STATUS_LABEL_OVERFLOW;
 		}
-		if (*pos + label_size > max) {
+		if (*pos + 1 + label_size > max) {
 			return LDNS_STATUS_LABEL_OVERFLOW;
 		}