From: Maxim Dounin <mdounin@mdounin.ru>
Date: Tue, 25 May 2021 12:17:38 +0000 (+0300)
Subject: Resolver: fixed off-by-one read in ngx_resolver_copy().
X-Git-Tag: release-1.21.0~5
X-Git-Url: http://www.kaiwu.me/postgresql/commit/static/gitweb.js?a=commitdiff_plain;h=077a890a76fff4f071776184aed881b5f314c98a;p=nginx.git

Resolver: fixed off-by-one read in ngx_resolver_copy().

It is believed to be harmless, and in the worst case it uses some
uninitialized memory as a part of the compression pointer length,
eventually leading to the "name is out of DNS response" error.
---

diff --git a/src/core/ngx_resolver.c b/src/core/ngx_resolver.c
index 63b26193d..9b1317234 100644
--- a/src/core/ngx_resolver.c
+++ b/src/core/ngx_resolver.c
@@ -3958,6 +3958,11 @@ ngx_resolver_copy(ngx_resolver_t *r, ngx_str_t *name, u_char *buf, u_char *src,
         }
 
         if (n & 0xc0) {
+            if (p >= last) {
+                err = "name is out of DNS response";
+                goto invalid;
+            }
+
             n = ((n & 0x3f) << 8) + *p;
             p = &buf[n];