1diff -Npur c-ares-1.15.0/ares_init.c c-ares-1.15.0-change/ares_init.c 2--- c-ares-1.15.0/ares_init.c 2018-10-11 05:20:12.000000000 +0800 3+++ c-ares-1.15.0-change/ares_init.c 2023-03-13 15:27:50.068885382 +0800 4@@ -2205,6 +2205,8 @@ static int config_sortlist(struct apatte 5 q = str; 6 while (*q && *q != '/' && *q != ';' && !ISSPACE(*q)) 7 q++; 8+ if (q-str >= 16) 9+ return ARES_EBADSTR; 10 memcpy(ipbuf, str, q-str); 11 ipbuf[q-str] = '\0'; 12 /* Find the prefix */ 13@@ -2213,6 +2215,8 @@ static int config_sortlist(struct apatte 14 const char *str2 = q+1; 15 while (*q && *q != ';' && !ISSPACE(*q)) 16 q++; 17+ if (q-str >= 32) 18+ return ARES_EBADSTR; 19 memcpy(ipbufpfx, str, q-str); 20 ipbufpfx[q-str] = '\0'; 21 str = str2; 22diff -Npur c-ares-1.15.0/test/ares-test-init.cc c-ares-1.15.0-change/test/ares-test-init.cc 23--- c-ares-1.15.0/test/ares-test-init.cc 2018-10-11 05:20:12.000000000 +0800 24+++ c-ares-1.15.0-change/test/ares-test-init.cc 2023-03-13 15:29:02.560881555 +0800 25@@ -270,6 +270,8 @@ TEST_F(DefaultChannelTest, SetAddresses) 26 27 TEST_F(DefaultChannelTest, SetSortlistFailures) { 28 EXPECT_EQ(ARES_ENODATA, ares_set_sortlist(nullptr, "1.2.3.4")); 29+ EXPECT_EQ(ARES_EBADSTR, ares_set_sortlist(channel_, "111.111.111.111*/16")); 30+ EXPECT_EQ(ARES_EBADSTR, ares_set_sortlist(channel_, "111.111.111.111/255.255.255.240*")); 31 EXPECT_EQ(ARES_SUCCESS, ares_set_sortlist(channel_, "xyzzy ; lwk")); 32 EXPECT_EQ(ARES_SUCCESS, ares_set_sortlist(channel_, "xyzzy ; 0x123")); 33 } 34