Possible DoS in whois (1.31), caused by memory exhaustion

[Erez Turjeman]

The implementation of `whois` in busybox 1.31 calls xrealloc without
limiting the size argument, which can lead to a memory exhaustion,
https://git.busybox.net/busybox/tree/networking/whois.c?h=1_31_stable#n63.
A rogue server can simply reply with an endless response until crashing the
client.
Regards,
Erez
-- 
Erez Turjeman
erezto at gmail.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.busybox.net/pipermail/busybox/attachments/20191202/f5178724/attachment.html>