diff options
| author | Stanislav Malyshev <stas@php.net> | 2018-12-29 20:39:08 -0800 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2019-01-06 11:39:09 -0800 |
| commit | 8d3dfabef459fe7815e8ea2fd68753fd17859d7b (patch) | |
| tree | 088713b64677f1d3cc3b9f08ff1c7c03e4e94a28 | |
| parent | 31f59e1f3074ab344b473dde6077a6844ca87264 (diff) | |
| download | php-git-8d3dfabef459fe7815e8ea2fd68753fd17859d7b.tar.gz | |
Fix #77369 - memcpy with negative length via crafted DNS response
| -rw-r--r-- | ext/standard/dns.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/ext/standard/dns.c b/ext/standard/dns.c index 8e102f816f..b5fbcb96f9 100644 --- a/ext/standard/dns.c +++ b/ext/standard/dns.c @@ -459,6 +459,10 @@ static u_char *php_parserr(u_char *cp, u_char *end, querybuf *answer, int type_t GETLONG(ttl, cp); GETSHORT(dlen, cp); CHECKCP(dlen); + if (dlen == 0) { + /* No data in the response - nothing to do */ + return NULL; + } if (type_to_fetch != T_ANY && type != type_to_fetch) { cp += dlen; return cp; @@ -549,6 +553,9 @@ static u_char *php_parserr(u_char *cp, u_char *end, querybuf *answer, int type_t CHECKCP(n); add_assoc_stringl(subarray, "tag", (char*)cp, n); cp += n; + if ( (size_t) dlen < ((size_t)n) + 2 ) { + return NULL; + } n = dlen - n - 2; CHECKCP(n); add_assoc_stringl(subarray, "value", (char*)cp, n); |