Fix bug in InitParseWithoutQuestion

net/dns/dns_response.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/dns/dns_response.h"
 
 #include "base/string_util.h"
 #include "base/sys_byteorder.h"
 #include "net/base/address_list.h"
 #include "net/base/big_endian.h"
@@ skipping 144 matching lines @@
     : io_buffer_(new IOBufferWithSize(length)),
       parser_(io_buffer_->data(), length, answer_offset) {
   DCHECK(data);
   memcpy(io_buffer_->data(), data, length);
 }
 
 DnsResponse::~DnsResponse() {
 }
 
 bool DnsResponse::InitParse(int nbytes, const DnsQuery& query) {
+  DCHECK_GE(nbytes, 0);
   // Response includes query, it should be at least that size.
   if (nbytes < query.io_buffer()->size() || nbytes >= io_buffer_->size())
     return false;
 
   // Match the query id.
   if (base::NetToHost16(header()->id) != query.id())
     return false;
 
   // Match question count.
   if (base::NetToHost16(header()->qdcount) != 1)
     return false;
 
   // Match the question section.
   const size_t hdr_size = sizeof(dns_protocol::Header);
   const base::StringPiece question = query.question();
   if (question != base::StringPiece(io_buffer_->data() + hdr_size,
                                     question.size())) {
     return false;
   }
 
   // Construct the parser.
   parser_ = DnsRecordParser(io_buffer_->data(),
                             nbytes,
                             hdr_size + question.size());
   return true;
 }
 
 bool DnsResponse::InitParseWithoutQuery(int nbytes) {
-  if (nbytes >= io_buffer_->size())
+  DCHECK_GE(nbytes, 0);
+
+  size_t hdr_size = sizeof(dns_protocol::Header);
+
+  if (nbytes < static_cast<int>(hdr_size) || nbytes >= io_buffer_->size())
     return false;
 
-  size_t hdr_size = sizeof(dns_protocol::Header);
   parser_ = DnsRecordParser(
       io_buffer_->data(), nbytes, hdr_size);
 
   unsigned qdcount = base::NetToHost16(header()->qdcount);
   for (unsigned i = 0; i < qdcount; ++i) {
     if (!parser_.SkipQuestion()) {
       parser_ = DnsRecordParser();  // Make parser invalid again.
       return false;
     }
   }
@@ skipping 112 matching lines @@
 
   // getcanonname in eglibc returns the first owner name of an A or AAAA RR.
   // If the response passed all the checks so far, then |expected_name| is it.
   *addr_list = AddressList::CreateFromIPAddressList(ip_addresses,
                                                     expected_name);
   *ttl = base::TimeDelta::FromSeconds(ttl_sec);
   return DNS_PARSE_OK;
 }
 
 }  // namespace net