From d7bbbcf4d84eaf359dc7d10dc36140666755bb9a Mon Sep 17 00:00:00 2001 From: Remi Gacogne Date: Fri, 10 May 2019 18:04:38 +0200 Subject: [PATCH] Ensure a valid range to string() in PacketReader::getUnquotedText() In some cases we might have called: string::string(InputIt first, InputIt last) with last < first, which is invalid. libstdc++ handles that gracefully by throwing an out-of-range exception but libc++ tries to allocate a negative value of bytes, which in turns triggers a request for a very large memory allocation, which fails. --- pdns/dnsparser.cc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pdns/dnsparser.cc b/pdns/dnsparser.cc index 233258a3ef..f89ff3f67a 100644 --- a/pdns/dnsparser.cc +++ b/pdns/dnsparser.cc @@ -484,6 +484,11 @@ string PacketReader::getUnquotedText(bool lenField) else stop_at = d_recordlen; + /* think unsigned overflow */ + if (stop_at < d_pos) { + throw std::out_of_range("getUnquotedText out of record range"); + } + if(stop_at == d_pos) return ""; -- 2.47.2