From: W.C.A. Wijngaards Date: Tue, 3 Dec 2019 15:18:47 +0000 (+0100) Subject: - Fix Out of Bound Write Compressed Names in rdata_copy(), X-Git-Tag: release-1.9.6rc1~15 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6c3a0b54ed8ace93d5b5ca7b8078dc87e75cd640;p=thirdparty%2Funbound.git - Fix Out of Bound Write Compressed Names in rdata_copy(), reported by X41 D-Sec. --- diff --git a/doc/Changelog b/doc/Changelog index bceb443e3..7e592710c 100644 --- a/doc/Changelog +++ b/doc/Changelog @@ -17,6 +17,8 @@ reported by X41 D-Sec. - Fix Insufficient Handling of Compressed Names in dname_pkt_copy(), reported by X41 D-Sec. + - Fix Out of Bound Write Compressed Names in rdata_copy(), + reported by X41 D-Sec. 2 December 2019: Wouter - Merge pull request #122 from he32: In tcp_callback_writer(), diff --git a/util/data/msgreply.c b/util/data/msgreply.c index a2c09ac20..4320f312d 100644 --- a/util/data/msgreply.c +++ b/util/data/msgreply.c @@ -243,10 +243,10 @@ rdata_copy(sldns_buffer* pkt, struct packed_rrset_data* data, uint8_t* to, break; } if(len) { + log_assert(len <= pkt_len); memmove(to, sldns_buffer_current(pkt), len); to += len; sldns_buffer_skip(pkt, (ssize_t)len); - log_assert(len <= pkt_len); pkt_len -= len; } rdf++;