diff options
Diffstat (limited to 'ares_parse_txt_reply.c')
| -rw-r--r-- | ares_parse_txt_reply.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/ares_parse_txt_reply.c b/ares_parse_txt_reply.c index dcc6473..3a43d6a 100644 --- a/ares_parse_txt_reply.c +++ b/ares_parse_txt_reply.c @@ -106,6 +106,11 @@ ares_parse_txt_reply (const unsigned char *abuf, int alen, rr_class = DNS_RR_CLASS (aptr); rr_len = DNS_RR_LEN (aptr); aptr += RRFIXEDSZ; + if (aptr + rr_len > abuf + alen) + { + status = ARES_EBADRESP; + break; + } /* Check if we are really looking at a TXT record */ if (rr_class == C_IN && rr_type == T_TXT) @@ -144,6 +149,12 @@ ares_parse_txt_reply (const unsigned char *abuf, int alen, strptr += substr_len + 1; } + if (strptr != (aptr + rr_len)) + { + status = ARES_EBADRESP; + break; + } + /* Including null byte */ txt_curr->txt = malloc (txt_curr->length + 1); if (txt_curr->txt == NULL) |