- up to 0.6.16 (fixes CVE-2006-6870)

[packages/avahi.git] / avahi-compressed_dns.patch

Index: avahi-core/dns.c
===================================================================
--- avahi-core/dns.c	(Revision 1339)
+++ avahi-core/dns.c	(Arbeitskopie)
@@ -331,7 +331,7 @@
 static int consume_labels(AvahiDnsPacket *p, unsigned idx, char *ret_name, size_t l) {
     int ret = 0;
     int compressed = 0;
-    int first_label = 1;
+    int first_label = 1, label_ptr;
     assert(p && ret_name && l);
     
     for (;;) {
@@ -384,8 +384,13 @@
             if (idx+2 > p->size)
                 return -1;
 
-            idx = ((unsigned) (AVAHI_DNS_PACKET_DATA(p)[idx] & ~0xC0)) << 8 | AVAHI_DNS_PACKET_DATA(p)[idx+1];
+            label_ptr = ((unsigned) (AVAHI_DNS_PACKET_DATA(p)[idx] & ~0xC0)) << 8 | AVAHI_DNS_PACKET_DATA(p)[idx+1];
 
+            if (label_ptr >= idx)
+                return -1;
+
+            idx = label_ptr;
+
             if (!compressed)
                 ret += 2;