mirror of https://github.com/c-ares/c-ares.git
Avoid buffer overflow in RC4 loop comparison (#336)
The rc4 function iterates over a buffer of size buffer_len who's maximum value is INT_MAX with a counter of type short that is not guaranteed to have maximum size INT_MAX. In circumstances where short is narrower than int and where buffer_len is larger than the maximum value of a short, it may be possible to loop infinitely as counter will overflow and never be greater than or equal to buffer_len. The solution is to make the comparison be between types of equal width. This commit defines counter as an int. Fix By: Fionn Fitzmaurice (@fionn)pull/339/head
parent
d561177542
commit
6d6cd5daf6
1 changed files with 1 additions and 1 deletions
Loading…
Reference in new issue