From dc544e80f94481619719137063b460c50116dee5 Mon Sep 17 00:00:00 2001 From: Kees Monshouwer Date: Mon, 13 Apr 2015 13:52:42 +0200 Subject: [PATCH] fix forward reference-check in getLabelFromContent() --- pdns/dnsparser.cc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pdns/dnsparser.cc b/pdns/dnsparser.cc index 77105d10bf..f6fc711566 100644 --- a/pdns/dnsparser.cc +++ b/pdns/dnsparser.cc @@ -462,6 +462,7 @@ void PacketReader::getLabelFromContent(const vector& content, uint16_t& if(recurs > 1000) // the forward reference-check below should make this test 100% obsolete throw MOADNSException("Loop"); // it is tempting to call reserve on ret, but it turns out it creates a malloc/free storm in the loop + int pos = frompos; for(;;) { unsigned char labellen=content.at(frompos++); @@ -474,7 +475,7 @@ void PacketReader::getLabelFromContent(const vector& content, uint16_t& uint16_t offset=256*(labellen & ~0xc0) + (unsigned int)content.at(frompos++) - sizeof(dnsheader); // cout<<"This is an offset, need to go to: "<= frompos-2) + if(offset >= pos-2) throw MOADNSException("forward reference during label decompression"); return getLabelFromContent(content, offset, ret, ++recurs); } -- 2.47.2