(xerces-c) branch xerces-3.3 updated: XERCESC-2264 - Bug in legacy gethostbyname calls in NetAccessors

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch xerces-3.3
in repository https://gitbox.apache.org/repos/asf/xerces-c.git


The following commit(s) were added to refs/heads/xerces-3.3 by this push:
     new 56b87e187 XERCESC-2264 - Bug in legacy gethostbyname calls in NetAccessors
56b87e187 is described below

commit 56b87e187dae4497e15931039537b74443389fe8
Author: Scott Cantor <[email protected]>
AuthorDate: Thu Aug 13 12:32:33 2026 -0400

    XERCESC-2264 - Bug in legacy gethostbyname calls in NetAccessors
    
    https://issues.apache.org/jira/browse/XERCESC-2264
---
 src/xercesc/util/NetAccessors/Socket/UnixHTTPURLInputStream.cpp | 9 +++++++--
 src/xercesc/util/NetAccessors/WinSock/BinHTTPURLInputStream.cpp | 8 ++++++--
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/src/xercesc/util/NetAccessors/Socket/UnixHTTPURLInputStream.cpp b/src/xercesc/util/NetAccessors/Socket/UnixHTTPURLInputStream.cpp
index e3adfb273..7e7430663 100644
--- a/src/xercesc/util/NetAccessors/Socket/UnixHTTPURLInputStream.cpp
+++ b/src/xercesc/util/NetAccessors/Socket/UnixHTTPURLInputStream.cpp
@@ -183,8 +183,13 @@ UnixHTTPURLInputStream::UnixHTTPURLInputStream(const XMLURL& urlSource, const XM
         }
 
         memset(&sa, '\0', sizeof(sockaddr_in));  // iSeries fix ??
-        memcpy((void *) &sa.sin_addr,
-            (const void *) hostEntPtr->h_addr, hostEntPtr->h_length);
+
+        if (hostEntPtr->h_length > sizeof(sa.sin_addr)) {
+            ThrowXMLwithMemMgr1(NetAccessorException,
+                XMLExcepts::NetAcc_TargetResolution, hostName, memoryManager);
+        }
+
+        memcpy((void *) &sa.sin_addr, (const void *) hostEntPtr->h_addr, hostEntPtr->h_length);
         sa.sin_family = hostEntPtr->h_addrtype;
         sa.sin_port = htons((unsigned short)url.getPortNum());
 
diff --git a/src/xercesc/util/NetAccessors/WinSock/BinHTTPURLInputStream.cpp b/src/xercesc/util/NetAccessors/WinSock/BinHTTPURLInputStream.cpp
index d62c3bfeb..4ee6b21ee 100644
--- a/src/xercesc/util/NetAccessors/WinSock/BinHTTPURLInputStream.cpp
+++ b/src/xercesc/util/NetAccessors/WinSock/BinHTTPURLInputStream.cpp
@@ -399,8 +399,12 @@ BinHTTPURLInputStream::BinHTTPURLInputStream(const XMLURL& urlSource, const XMLN
             }
         }
 
-        memcpy((void *) &sa.sin_addr,
-            (const void *) hostEntPtr->h_addr, hostEntPtr->h_length);
+        if (hostEntPtr->h_length > sizeof(sa.sin_addr)) {
+            ThrowXMLwithMemMgr1(NetAccessorException,
+                XMLExcepts::NetAcc_TargetResolution, hostName, memoryManager);
+        }
+
+        memcpy((void *) &sa.sin_addr, (const void *) hostEntPtr->h_addr, hostEntPtr->h_length);
         sa.sin_family = hostEntPtr->h_addrtype;
         sa.sin_port = wrap_htons((unsigned short)url.getPortNum());