Changeset 5115 for pjproject/trunk

Timestamp:

Jun 22, 2015 8:49:34 AM (9 years ago)

Author:

ming

Message:

Re #1843 (misc): Fixed potential memory corruption problem if DNS resolver receives a response with more than 8 A records.

Thank you to Oleg Grazhdan for the patch and Andrey Kovalenko for the report

File:

• pjproject/trunk/pjlib-util/src/pjlib-util/srv_resolver.c (modified) (1 diff)

pjproject/trunk/pjlib-util/src/pjlib-util/srv_resolver.c

@@ -330 +330 @@
          */
         for (j=0; j<query_job->srv_cnt; ++j) {
-            if (pj_stricmp(&rr->name, &query_job->srv[j].target_name)==0) {
+            if (pj_stricmp(&rr->name, &query_job->srv[j].target_name)==0 &&
+                query_job->srv[j].addr_cnt < ADDR_MAX_COUNT)
+            {
                 unsigned cnt = query_job->srv[j].addr_cnt;
                 query_job->srv[j].addr[cnt].s_addr = rr->rdata.a.ip_addr.s_addr;