Miroslav Lichvar 7925ed39b8 nts: fix handling of long server negotiation record ...

Recent change in handling of the NTPv4 server negotiation record (commit
754097944b) increased the length of the instance name buffer to make
room for the trailing dot. This allowed a record with body truncated in
the processing buffer to be accepted and caused an over-read of 1 byte
in the memcpy() call saving the name to the instance buffer.

Modify the client to accept only records that fit in the processing
buffer.

Fixes: 754097944b ("nts: handle negotiated server as FQDN")

2021-04-29 09:44:18 +02:00

12 KiB

Raw Blame History

View Raw