Fix for buffer overflow in command-line arguments to dnsquery(1) which

will be appearing in 8.2.3

Approved by:	Paul A Vixie <vixie@mibh.net>

1 files changed, 12 insertions, 2 deletions

diff --git a/contrib/bind/bin/dnsquery/dnsquery.c b/contrib/bind/bin/dnsquery/dnsquery.c
index 218c8a8..31d5d62 100644
--- a/contrib/bind/bin/dnsquery/dnsquery.c
+++ b/contrib/bind/bin/dnsquery/dnsquery.c
@@ -80,7 +80,12 @@ main(int argc, char *argv[]) {
 		case 'p' :	res.retrans = atoi(optarg);
 				break;
 
-		case 'h' :	strcpy(name, optarg);
+		case 'h' :	if (strlen(optarg) >= sizeof(name)) {
+					fprintf(stderr,
+						"Domain name too long (%s)\n", optarg);
+					exit(-1);
+				} else
+					strcpy(name, optarg);
 				break;
 
 		case 'c' : {
@@ -158,7 +163,12 @@ main(int argc, char *argv[]) {
 		}
 	}
 	if (optind < argc)
-		strcpy(name, argv[optind]);
+		if (strlen(argv[optind]) >= sizeof(name)) {
+			fprintf(stderr,
+				"Domain name too long (%s)\n", argv[optind]);
+			exit(-1);
+		} else
+			strcpy(name, argv[optind]);
 
 	len = sizeof(answer);