2305. [security] inet_network() buffer overflow. CVE-2008-0122.

diff --git a/CHANGES b/CHANGES
index 9ae00a770f4bb3e2551662b8c2cbe45c5c520cb9..e9b33fd19bc5dae031222e0a40a57e804264565e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+2305.  [security]      inet_network() buffer overflow. CVE-2008-0122.
+
 2304.  [bug]           Check returns from all dns_rdata_tostruct() calls.
                        [RT #17460]
 

diff --git a/lib/bind/inet/inet_network.c b/lib/bind/inet/inet_network.c
index 4758a00f2651f2f94dcd32dd16d87883ffe8736b..47976cff68d8c77ac1b8abcaeb690e567040c010 100644 (file)
--- a/lib/bind/inet/inet_network.c
+++ b/lib/bind/inet/inet_network.c
@@ -84,9 +84,9 @@ again:
        }
        if (!digit)
                return (INADDR_NONE);
+       if (pp >= parts + 4 || val > 0xffU)
+               return (INADDR_NONE);
        if (*cp == '.') {
-               if (pp >= parts + 4 || val > 0xffU)
-                       return (INADDR_NONE);
                *pp++ = val, cp++;
                goto again;
        }