* avahi-core/dns.c#consume_labels(): Add some additional checks on the compressed...

git-svn-id: file:///home/lennart/svn/public/avahi/trunk@1342 941a03a8-eaeb-0310-b9a0-b1bbd8fe43fe

diff --git a/avahi-core/dns.c b/avahi-core/dns.c
index a3ec0e6274f004e92e67b200b4847e1f23bbff48..b31aa20820cc3d9fec2d647b042b0331a0129d78 100644 (file)
--- a/avahi-core/dns.c
+++ b/avahi-core/dns.c
@@ -332,6 +332,7 @@ static int consume_labels(AvahiDnsPacket *p, unsigned idx, char *ret_name, size_
     int ret = 0;
     int compressed = 0;
     int first_label = 1;
+    unsigned label_ptr;
     int i;
     assert(p && ret_name && l);
     
@@ -385,7 +386,12 @@ static int consume_labels(AvahiDnsPacket *p, unsigned idx, char *ret_name, size_
             if (idx+2 > p->size)
                 return -1;
 
-            idx = ((unsigned) (AVAHI_DNS_PACKET_DATA(p)[idx] & ~0xC0)) << 8 | AVAHI_DNS_PACKET_DATA(p)[idx+1];
+            label_ptr = ((unsigned) (AVAHI_DNS_PACKET_DATA(p)[idx] & ~0xC0)) << 8 | AVAHI_DNS_PACKET_DATA(p)[idx+1];
+
+            if ((label_ptr < AVAHI_DNS_PACKET_HEADER_SIZE) || (label_ptr >= idx))
+                return -1;
+
+            idx = label_ptr;
 
             if (!compressed)
                 ret += 2;