Fix bug in InitParseWithoutQuestion

net/dns/dns_response.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/dns/dns_response.h"
 
 #include "base/string_util.h"
 #include "base/sys_byteorder.h"
 #include "net/base/address_list.h"
 #include "net/base/big_endian.h"
@@ skipping 172 matching lines @@
   }
 
   // Construct the parser.
   parser_ = DnsRecordParser(io_buffer_->data(),
                             nbytes,
                             hdr_size + question.size());
   return true;
 }
 
 bool DnsResponse::InitParseWithoutQuery(int nbytes) {
-  if (nbytes >= io_buffer_->size())
+  if (nbytes < 0 ||

[szym, 2013/05/17 20:43:21]

nbytes < 0 is an error. You should probably DCHECK(nbytes >= 0);

[Noam Samuel, 2013/05/17 20:52:44]

Done.

+      (unsigned)nbytes < sizeof(dns_protocol::Header) ||
+      nbytes >= io_buffer_->size())
     return false;
 
   size_t hdr_size = sizeof(dns_protocol::Header);
   parser_ = DnsRecordParser(
       io_buffer_->data(), nbytes, hdr_size);
 
   unsigned qdcount = base::NetToHost16(header()->qdcount);
   for (unsigned i = 0; i < qdcount; ++i) {
     if (!parser_.SkipQuestion()) {
       parser_ = DnsRecordParser();  // Make parser invalid again.
@@ skipping 115 matching lines @@
 
   // getcanonname in eglibc returns the first owner name of an A or AAAA RR.
   // If the response passed all the checks so far, then |expected_name| is it.
   *addr_list = AddressList::CreateFromIPAddressList(ip_addresses,
                                                     expected_name);
   *ttl = base::TimeDelta::FromSeconds(ttl_sec);
   return DNS_PARSE_OK;
 }
 
 }  // namespace net