提交 84a7c0b1 编写于 作者: M Manuel Schölling 提交者: David S. Miller

dns_resolver: assure that dns_query() result is null-terminated

dns_query() credulously assumes that keys are null-terminated and
returns a copy of a memory block that is off by one.
Signed-off-by: NManuel Schölling <manuel.schoelling@gmx.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 2346829e
...@@ -149,7 +149,9 @@ int dns_query(const char *type, const char *name, size_t namelen, ...@@ -149,7 +149,9 @@ int dns_query(const char *type, const char *name, size_t namelen,
if (!*_result) if (!*_result)
goto put; goto put;
memcpy(*_result, upayload->data, len + 1); memcpy(*_result, upayload->data, len);
*_result[len] = '\0';
if (_expiry) if (_expiry)
*_expiry = rkey->expiry; *_expiry = rkey->expiry;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册