Another 10363 instance -- this one in the eventdns.c code

diff --git a/changes/bug10363 b/changes/bug10363
index a3c9905e36d5564cba958ea85c1d5e77c470d32e..0cdfd9aeebaf78d9b48756907467cb4a664acd9a 100644 (file)
--- a/changes/bug10363
+++ b/changes/bug10363
@@ -6,4 +6,7 @@
     - Fix another possibly undefined pointer operations in tor_memmem
       fallback implementation. Another case of bug #10363; bugfix on
       0.1.1.1-alpha.
+    - Fix another possibly undefined pointer operations in the eventdns
+      fallback implementation. Another case of bug #10363; bugfix on
+      0.1.2.1-alpha.
 

diff --git a/src/ext/eventdns.c b/src/ext/eventdns.c
index 66280cccdb5be84ba1400c9172b37062bac0b220..a64c5627b6a65e8c0710671efacf5a2303ff8016 100644 (file)
--- a/src/ext/eventdns.c
+++ b/src/ext/eventdns.c
@@ -842,10 +842,11 @@ name_parse(u8 *packet, int length, int *idx, char *name_out, size_t name_out_len
                }
                if (label_len > 63) return -1;
                if (cp != name_out) {
-                       if (cp + 1 >= end) return -1;
+                       if (cp >= name_out + name_out_len - 1) return -1;
                        *cp++ = '.';
                }
-               if (cp + label_len >= end) return -1;
+               if (label_len > name_out_len ||
+                       cp >= name_out + name_out_len - label_len) return -1;
                memcpy(cp, packet + j, label_len);
                cp += label_len;
                j += label_len;