From: bradh352 <brad@brad-house.com>
Date: Fri, 11 Jun 2021 12:39:24 -0400
Subject: [2/2] ares_expand_name(): fix formatting and handling of root name
 response
Origin: https://github.com/c-ares/c-ares/commit/44c009b8e62ea1929de68e3f438181bea469ec14
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2021-3672

Fixes issue introduced in prior commit with formatting and handling
of parsing a root name response which should not be escaped.

Fix By: Brad House
CVE: CVE-2021-3672
Upstream-Status: Backport [http://snapshot.debian.org/archive/debian-security/20210810T064453Z/pool/updates/main/c/c-ares/c-ares_1.17.1-1%2Bdeb11u1.debian.tar.xz]
Signed-off-by: Neetika Singh <Neetika.Singh@kpit.com>
---
 ares_expand_name.c | 62 ++++++++++++++++++++++++--------------
 1 file changed, 40 insertions(+), 22 deletions(-)

diff --git a/ares_expand_name.c b/ares_expand_name.c
index f1c874a97cfc..eb9268c1ff0a 100644
--- a/ares_expand_name.c
+++ b/ares_expand_name.c
@@ -127,27 +127,37 @@ int ares_expand_name(const unsigned char *encoded, const unsigned char *abuf,
         }
       else
         {
-          len = *p;
+          int name_len = *p;
+          len = name_len;
           p++;
+
           while (len--)
             {
-              if (!isprint(*p)) {
-                /* Output as \DDD for consistency with RFC1035 5.1 */
-                *q++ = '\\';
-                *q++ = '0' + *p / 100;
-                *q++ = '0' + (*p % 100) / 10;
-                *q++ = '0' + (*p % 10);
-              } else if (is_reservedch(*p)) {
-                *q++ = '\\';
-                *q++ = *p;
-              } else {
-                *q++ = *p;
-              }
+              /* Output as \DDD for consistency with RFC1035 5.1, except
+               * for the special case of a root name response  */
+              if (!isprint(*p) && !(name_len == 1 && *p == 0))
+                {
+
+                  *q++ = '\\';
+                  *q++ = '0' + *p / 100;
+                  *q++ = '0' + (*p % 100) / 10;
+                  *q++ = '0' + (*p % 10);
+                }
+              else if (is_reservedch(*p))
+                {
+                  *q++ = '\\';
+                  *q++ = *p;
+                }
+              else
+                {
+                  *q++ = *p;
+                }
               p++;
             }
           *q++ = '.';
         }
-    }
+     }
+
   if (!indir)
     *enclen = aresx_uztosl(p + 1U - encoded);
 
@@ -194,21 +204,29 @@ static int name_length(const unsigned char *encoded, const unsigned char *abuf,
         }
       else if (top == 0x00)
         {
-          offset = *encoded;
+          int name_len = *encoded;
+          offset = name_len;
           if (encoded + offset + 1 >= abuf + alen)
             return -1;
           encoded++;
+
           while (offset--)
             {
-              if (!isprint(*encoded)) {
-                n += 4;
-              } else if (is_reservedch(*encoded)) {
-                n += 2;
-              } else {
-                n += 1;
-              }
+              if (!isprint(*encoded) && !(name_len == 1 && *encoded == 0))
+                {
+                  n += 4;
+                }
+              else if (is_reservedch(*encoded))
+                {
+                  n += 2;
+                }
+              else
+                {
+                  n += 1;
+                }
               encoded++;
             }
+
           n++;
         }
       else
-- 
2.32.0