From 8ed9da7324538891b2ad37e369e1038cf4802c19 Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Sat, 15 Aug 2020 08:50:37 +1000 Subject: [PATCH] dns_rdata_fromwire() only accepts input up to 2^16-1 octets. (cherry picked from commit aa811801cbfec1215f7faee77be9d0c68774914f) --- fuzz/dns_rdata_fromwire_text.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fuzz/dns_rdata_fromwire_text.c b/fuzz/dns_rdata_fromwire_text.c index 97d8a02e52..ebf76da428 100644 --- a/fuzz/dns_rdata_fromwire_text.c +++ b/fuzz/dns_rdata_fromwire_text.c @@ -82,8 +82,12 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { unsigned int classes = (sizeof(classlist) / sizeof(classlist[0])); unsigned int types = 1, flags, t; - if (size < 2) { - goto done; + /* + * First 2 bytes are used to select type and class. + * dns_rdata_fromwire() only accepts input up to 2^16-1 octets. + */ + if (size < 2 || size > 0xffff + 2) { + return (0); } /*