diff options
author | imp <imp@FreeBSD.org> | 2002-06-26 08:18:05 +0000 |
---|---|---|
committer | imp <imp@FreeBSD.org> | 2002-06-26 08:18:05 +0000 |
commit | 8df35cae5920770f3ca2040b56aa6e1cdc468740 (patch) | |
tree | b14e0dd837f4e2c6781a3fc42b342907035ab95b /lib/libc/net/map_v4v6.c | |
parent | 167db86ab54e9dbae6e6c3fd7f8f14b80f188420 (diff) | |
download | FreeBSD-src-8df35cae5920770f3ca2040b56aa6e1cdc468740.zip FreeBSD-src-8df35cae5920770f3ca2040b56aa6e1cdc468740.tar.gz |
Include more robust checking of end of buffer that more completely
plugs the hole.
Diffstat (limited to 'lib/libc/net/map_v4v6.c')
-rw-r--r-- | lib/libc/net/map_v4v6.c | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/lib/libc/net/map_v4v6.c b/lib/libc/net/map_v4v6.c index c3bab94..c8aaa3a 100644 --- a/lib/libc/net/map_v4v6.c +++ b/lib/libc/net/map_v4v6.c @@ -99,10 +99,10 @@ _map_v4v6_address(src, dst) } void -_map_v4v6_hostent(hp, bpp, lenp) +_map_v4v6_hostent(hp, bpp, epp) struct hostent *hp; char **bpp; - int *lenp; + char **epp; { char **ap; @@ -113,16 +113,14 @@ _map_v4v6_hostent(hp, bpp, lenp) for (ap = hp->h_addr_list; *ap; ap++) { int i = sizeof(align) - ((u_long)*bpp % sizeof(align)); - if (*lenp < (i + IN6ADDRSZ)) { + if (*epp - *bpp < (i + IN6ADDRSZ)) { /* Out of memory. Truncate address list here. XXX */ *ap = NULL; return; } *bpp += i; - *lenp -= i; _map_v4v6_address(*ap, *bpp); *ap = *bpp; *bpp += IN6ADDRSZ; - *lenp -= IN6ADDRSZ; } } |