cubixle/packages
1
0
Fork 0
mirror of https://github.com/novatiq/packages.git synced 2026-04-30 15:38:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

ldns: Fix two CVEs

Browse Source 
CVE-2017-1000231 and CVE-2017-1000232.

Taken from Fedora.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
This commit is contained in:
Rosen Penev
2018-08-26 21:03:28 -07:00
parent 8938517832
commit 7f561b97c3
3 changed files with 60 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libs/ldns/patches/101-CVE-2017-1000232.patch
+30
View File
@@ -0,0 +1,30 @@
From 3bdeed02505c9bbacb3b64a97ddcb1de967153b7 Mon Sep 17 00:00:00 2001
From: Willem Toorop <willem@nlnetlabs.nl>
Date: Thu, 27 Apr 2017 00:25:20 +0200
Subject: [PATCH] bugfix #1257: Free after reallocing to 0 size
Thanks Stephan Zeisberg
---
str2host.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/str2host.c b/str2host.c
index b274b17..f2a317b 100644
--- a/str2host.c
+++ b/str2host.c
@@ -1525,8 +1525,10 @@ ldns_str2rdf_long_str(ldns_rdf **rd, const char *str)
if (! str) {
return LDNS_STATUS_SYNTAX_BAD_ESCAPE;
}
- length = (size_t)(dp - data);
-
+ if (!(length = (size_t)(dp - data))) {
+ LDNS_FREE(data);
+ return LDNS_STATUS_SYNTAX_EMPTY;
+ }
/* Lose the overmeasure */
data = LDNS_XREALLOC(dp = data, uint8_t, length);
if (! data) {
--
2.9.5