diff options
| author | Florian Weimer <fweimer@redhat.com> | 2016-12-31 20:22:09 +0100 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2016-12-31 20:27:44 +0100 |
| commit | fc82b0a2dfe7dbd35671c10510a8da1043d746a5 (patch) | |
| tree | 86b8ef6421ca34fa1907121e078e008c580029ea /resolv/res_query.c | |
| parent | 3c589b1a8a4401e258ba23a03fcbcc79b82393ab (diff) | |
CVE-2015-5180: resolv: Fix crash with internal QTYPE [BZ #18784]
Also rename T_UNSPEC because an upcoming public header file
update will use that name.
Diffstat (limited to 'resolv/res_query.c')
| -rw-r--r-- | resolv/res_query.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/resolv/res_query.c b/resolv/res_query.c index 944d1a90f5..07dc6f6583 100644 --- a/resolv/res_query.c +++ b/resolv/res_query.c @@ -122,7 +122,7 @@ __libc_res_nquery(res_state statp, int n, use_malloc = 0; u_int oflags = statp->_flags; - size_t bufsize = (type == T_UNSPEC ? 2 : 1) * QUERYSIZE; + size_t bufsize = (type == T_QUERY_A_AND_AAAA ? 2 : 1) * QUERYSIZE; u_char *buf = alloca (bufsize); u_char *query1 = buf; int nquery1 = -1; @@ -137,7 +137,7 @@ __libc_res_nquery(res_state statp, printf(";; res_query(%s, %d, %d)\n", name, class, type); #endif - if (type == T_UNSPEC) + if (type == T_QUERY_A_AND_AAAA) { n = res_nmkquery(statp, QUERY, name, class, T_A, NULL, 0, NULL, query1, bufsize); @@ -190,7 +190,7 @@ __libc_res_nquery(res_state statp, if (__builtin_expect (n <= 0, 0) && !use_malloc) { /* Retry just in case res_nmkquery failed because of too short buffer. Shouldn't happen. */ - bufsize = (type == T_UNSPEC ? 2 : 1) * MAXPACKET; + bufsize = (type == T_QUERY_A_AND_AAAA ? 2 : 1) * MAXPACKET; buf = malloc (bufsize); if (buf != NULL) { query1 = buf; |