summaryrefslogtreecommitdiff
path: root/llmnr-query.c
diff options
context:
space:
mode:
authorTobias Klauser <tklauser@distanz.ch>2016-08-03 10:31:46 +0200
committerTobias Klauser <tklauser@distanz.ch>2016-08-03 10:31:46 +0200
commitc36d446a9b5b3b6a8b8d4f57c65c319c66968310 (patch)
treed8ae2c316e89a3177440be1f77c0933475ca7f60 /llmnr-query.c
parent5939d09f16547ab935d8e3699688ed1817471da5 (diff)
llmnr-query: Prevent read buffer overflow in response parsing
When accessing the compressed name in a response, verify that the pointer is within the packet size. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Diffstat (limited to 'llmnr-query.c')
-rw-r--r--llmnr-query.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/llmnr-query.c b/llmnr-query.c
index fefcf0b..27a2034 100644
--- a/llmnr-query.c
+++ b/llmnr-query.c
@@ -306,9 +306,13 @@ int main(int argc, char **argv)
/* compression? */
if (nl & 0xC0) {
uint16_t ptr = (nl & 0x3F) << 8 | *pkt_put(p, 1);
- name = (char *)p->data + ptr + 1;
- } else
+ if (ptr < p->size - 1)
+ name = (char *)p->data + ptr + 1;
+ else
+ name = "<invalid>";
+ } else {
name = (char *)pkt_put(p, nl + 1);
+ }
type = htons(*(uint16_t *)pkt_put(p, sizeof(type)));
clss = htons(*(uint16_t *)pkt_put(p, sizeof(clss)));