check cp bounds before reading A6 partial short in php_parserr

alhudz · alhudz · commit 26850548c811 · 2026-06-01T19:05:31.000+05:30
diff --git a/ext/standard/dns.c b/ext/standard/dns.c
@@ -678,6 +678,7 @@ static uint8_t *php_parserr(uint8_t *cp, uint8_t *end, querybuf *answer, int typ
 			}
 			if (n % 16 > 8) {
 				/* Partial short */
+				CHECKCP(1);
 				if (cp[0] != 0) {
 					if (tp > (uint8_t *)name) {
 						in_v6_break = 0;

Original file line number	Diff line number	Diff line change
`@@ -678,6 +678,7 @@ static uint8_t php_parserr(uint8_t cp, uint8_t end, querybuf answer, int typ`
`678`	`678`	`}`
`679`	`679`	`if (n % 16 > 8) {`
`680`	`680`	`/* Partial short */`
	`681`	`+ CHECKCP(1);`
`681`	`682`	`if (cp[0] != 0) {`
`682`	`683`	`if (tp > (uint8_t *)name) {`
`683`	`684`	`in_v6_break = 0;`