@@ -550,15 +550,24 @@ void MDNSResponder::_parsePacket(){
550
550
}
551
551
if (tmp8 & 0xC0 ) { // Compressed pointer
552
552
uint16_t offset = ((((uint16_t )tmp8) & ~0xC0 ) << 8 ) | _conn_read8 ();
553
- last_bufferpos = _conn->tell ();
553
+ if (_conn->isValidOffset (offset)) {
554
+ last_bufferpos = _conn->tell ();
554
555
#ifdef DEBUG_ESP_MDNS_RX
555
- DEBUG_ESP_PORT.print (" Compressed pointer, jumping from " );
556
- DEBUG_ESP_PORT.print (last_bufferpos);
557
- DEBUG_ESP_PORT.print (" to " );
558
- DEBUG_ESP_PORT.println (offset);
556
+ DEBUG_ESP_PORT.print (" Compressed pointer, jumping from " );
557
+ DEBUG_ESP_PORT.print (last_bufferpos);
558
+ DEBUG_ESP_PORT.print (" to " );
559
+ DEBUG_ESP_PORT.println (offset);
559
560
#endif
560
- _conn->seek (offset);
561
- tmp8 = _conn_read8 ();
561
+ _conn->seek (offset);
562
+ tmp8 = _conn_read8 ();
563
+ }
564
+ else {
565
+ #ifdef DEBUG_ESP_MDNS_RX
566
+ DEBUG_ESP_PORT.print (" Skipping malformed compressed pointer" );
567
+ #endif
568
+ tmp8 = _conn_read8 ();
569
+ break ;
570
+ }
562
571
}
563
572
if (stringsRead > 3 ){
564
573
#ifdef DEBUG_ESP_MDNS_RX
@@ -661,15 +670,24 @@ void MDNSResponder::_parsePacket(){
661
670
tmp8 = _conn_read8 ();
662
671
if (tmp8 & 0xC0 ) { // Compressed pointer
663
672
uint16_t offset = ((((uint16_t )tmp8) & ~0xC0 ) << 8 ) | _conn_read8 ();
664
- last_bufferpos = _conn->tell ();
673
+ if (_conn->isValidOffset (offset)) {
674
+ last_bufferpos = _conn->tell ();
665
675
#ifdef DEBUG_ESP_MDNS_RX
666
- DEBUG_ESP_PORT.print (" Compressed pointer, jumping from " );
667
- DEBUG_ESP_PORT.print (last_bufferpos);
668
- DEBUG_ESP_PORT.print (" to " );
669
- DEBUG_ESP_PORT.println (offset);
676
+ DEBUG_ESP_PORT.print (" Compressed pointer, jumping from " );
677
+ DEBUG_ESP_PORT.print (last_bufferpos);
678
+ DEBUG_ESP_PORT.print (" to " );
679
+ DEBUG_ESP_PORT.println (offset);
670
680
#endif
671
- _conn->seek (offset);
672
- tmp8 = _conn_read8 ();
681
+ _conn->seek (offset);
682
+ tmp8 = _conn_read8 ();
683
+ }
684
+ else {
685
+ #ifdef DEBUG_ESP_MDNS_RX
686
+ DEBUG_ESP_PORT.print (" Skipping malformed compressed pointer" );
687
+ #endif
688
+ tmp8 = _conn_read8 ();
689
+ break ;
690
+ }
673
691
}
674
692
_conn_readS (answerHostName, tmp8);
675
693
answerHostName[tmp8] = ' \0 ' ;
0 commit comments