mirror of
http://thekelleys.org.uk/git/dnsmasq.git
synced 2026-10-14 10:29:33 +00:00
073082ddc0aba7b8efa15a688d6183463b65effa
Thanks to Hugo Martinez Ray for spotting this. The value of rdlen for an RR can be a lie, allowing the call to extract_name() at rfc1025.c:952 to advance the value of p1 past the calculated end of the record. The makes the calculation of bytes remaining in the RR underflow to a huge number and results in a massive heap OOB read and certain crash.
Languages
C
94.3%
Perl
2.2%
HTML
1.2%
Shell
1%
Makefile
0.6%
Other
0.6%