diff -Npur c-ares-1.15.0/ares_init.c c-ares-1.15.0-change/ares_init.c
--- c-ares-1.15.0/ares_init.c	2018-10-11 05:20:12.000000000 +0800
+++ c-ares-1.15.0-change/ares_init.c	2023-03-13 15:27:50.068885382 +0800
@@ -2205,6 +2205,8 @@ static int config_sortlist(struct apatte
       q = str;
       while (*q && *q != '/' && *q != ';' && !ISSPACE(*q))
         q++;
+      if (q-str >= 16)
+        return ARES_EBADSTR;
       memcpy(ipbuf, str, q-str);
       ipbuf[q-str] = '\0';
       /* Find the prefix */
@@ -2213,6 +2215,8 @@ static int config_sortlist(struct apatte
           const char *str2 = q+1;
           while (*q && *q != ';' && !ISSPACE(*q))
             q++;
+          if (q-str >= 32)
+            return ARES_EBADSTR;
           memcpy(ipbufpfx, str, q-str);
           ipbufpfx[q-str] = '\0';
           str = str2;
diff -Npur c-ares-1.15.0/test/ares-test-init.cc c-ares-1.15.0-change/test/ares-test-init.cc
--- c-ares-1.15.0/test/ares-test-init.cc	2018-10-11 05:20:12.000000000 +0800
+++ c-ares-1.15.0-change/test/ares-test-init.cc	2023-03-13 15:29:02.560881555 +0800
@@ -270,6 +270,8 @@ TEST_F(DefaultChannelTest, SetAddresses)
 
 TEST_F(DefaultChannelTest, SetSortlistFailures) {
   EXPECT_EQ(ARES_ENODATA, ares_set_sortlist(nullptr, "1.2.3.4"));
+  EXPECT_EQ(ARES_EBADSTR, ares_set_sortlist(channel_, "111.111.111.111*/16"));
+  EXPECT_EQ(ARES_EBADSTR, ares_set_sortlist(channel_, "111.111.111.111/255.255.255.240*"));
   EXPECT_EQ(ARES_SUCCESS, ares_set_sortlist(channel_, "xyzzy ; lwk"));
   EXPECT_EQ(ARES_SUCCESS, ares_set_sortlist(channel_, "xyzzy ; 0x123"));
 }