diff --git a/ChangeLog b/ChangeLog index 7437e1b..0b40548 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,5 @@ 0.12.0 + - Fix potential infinite loop in resolver (#200) - Add code coverage support - New API: - xmpp_stanza_get_child_by_path() diff --git a/src/resolver.c b/src/resolver.c index 0a6b324..22ef952 100644 --- a/src/resolver.c +++ b/src/resolver.c @@ -321,6 +321,9 @@ static unsigned message_name_get(const unsigned char *buf, if (i >= buf_len) return 0; pointer = (label_len & 0x3f) << 8 | buf[i++]; + /* Prevent infinite looping */ + if (pointer == buf_offset) + return 0; if (name != NULL && name_len >= name_max && name_max > 0) { /* We have filled the name buffer. Don't pass it recursively. */ name[name_max - 1] = '\0';