1 files changed, 54 insertions, 0 deletions
diff --git a/main/nodejs/CVE-2017-1000381.patch b/main/nodejs/CVE-2017-1000381.patch
new file mode 100644
index 0000000000..ae8212226c
--- /dev/null
+++ b/main/nodejs/CVE-2017-1000381.patch
@@ -0,0 +1,54 @@
+From 75bc33d16fbc46f026cf913a08dff80167c370d1 Mon Sep 17 00:00:00 2001
+From: David Drysdale <drysdale@google.com>
+Date: Mon, 22 May 2017 10:54:10 +0100
+Subject: [PATCH] deps: cherry-pick 9478908a49 from cares upstream
+
+Original commit message:
+
+  ares_parse_naptr_reply: check sufficient data
+
+  Check that there is enough data for the required elements
+  of an NAPTR record (2 int16, 3 bytes for string lengths)
+  before processing a record.
+
+This patch fixes CVE-2017-1000381
+
+The c-ares function ares_parse_naptr_reply(), which is used for
+parsing NAPTR responses, could be triggered to read memory outside
+of the given input buffer if the passed in DNS response packet was
+crafted in a particular way.
+
+Refs: https://c-ares.haxx.se/adv_20170620.html
+Refs: https://c-ares.haxx.se/CVE-2017-1000381.patch
+PR-URL: https://github.com/nodejs/node-private/pull/88
+Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
+Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
+
+Patch-Source: https://github.com/nodejs/node/commit/75bc33d16f
+See: https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/
+---
+ deps/cares/src/ares_parse_naptr_reply.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/deps/cares/src/ares_parse_naptr_reply.c b/deps/cares/src/ares_parse_naptr_reply.c
+index 11634df984..717d355778 100644
+--- a/deps/cares/src/ares_parse_naptr_reply.c
++++ b/deps/cares/src/ares_parse_naptr_reply.c
+@@ -110,6 +110,12 @@ ares_parse_naptr_reply (const unsigned char *abuf, int alen,
+           status = ARES_EBADRESP;
+           break;
+         }
++      /* RR must contain at least 7 bytes = 2 x int16 + 3 x name */
++      if (rr_len < 7)
++        {
++          status = ARES_EBADRESP;
++          break;
++        }
+ 
+       /* Check if we are really looking at a NAPTR record */
+       if (rr_class == C_IN && rr_type == T_NAPTR)
+@@ -185,4 +191,3 @@ ares_parse_naptr_reply (const unsigned char *abuf, int alen,
+ 
+   return ARES_SUCCESS;
+ }
+-