deps: backport b5135bbc from c-ares repo

Original commit message:

    ares_parse_txt_reply: return a ares_txt_reply node for each sub-string

    Previously, the function would wrongly return all substrings merged into
    one.

fix #6931

deps/cares/src/ares_parse_txt_reply.c

@@ -54,7 +54,7 @@ int
 ares_parse_txt_reply (const unsigned char *abuf, int alen,
                       struct ares_txt_reply **txt_out)
 {
-  size_t substr_len, str_len;
+  size_t substr_len;
   unsigned int qdcount, ancount, i;
   const unsigned char *aptr;
   const unsigned char *strptr;
@@ -116,6 +116,26 @@ ares_parse_txt_reply (const unsigned char *abuf, int alen,
       /* Check if we are really looking at a TXT record */
       if (rr_class == C_IN && rr_type == T_TXT)
         {
+          /*
+           * There may be multiple substrings in a single TXT record. Each
+           * substring may be up to 255 characters in length, with a
+           * "length byte" indicating the size of the substring payload.
+           * RDATA contains both the length-bytes and payloads of all
+           * substrings contained therein.
+           */
+
+          strptr = aptr;
+          while (strptr < (aptr + rr_len))
+            {
+              substr_len = (unsigned char)*strptr;
+              if (strptr + substr_len + 1 > aptr + rr_len)
+                {
+                  status = ARES_EBADRESP;
+                  break;
+                }
+
+              ++strptr;
+
               /* Allocate storage for this TXT answer appending it to the list */
               txt_curr = ares_malloc_data(ARES_DATATYPE_TXT_REPLY);
               if (!txt_curr)
@@ -133,44 +153,20 @@ ares_parse_txt_reply (const unsigned char *abuf, int alen,
                 }
               txt_last = txt_curr;
 
-          /*
-           * There may be multiple substrings in a single TXT record. Each
-           * substring may be up to 255 characters in length, with a
-           * "length byte" indicating the size of the substring payload.
-           * RDATA contains both the length-bytes and payloads of all
-           * substrings contained therein.
-           */
-
-          /* Compute total length to allow a single memory allocation */
-          strptr = aptr;
-          while (strptr < (aptr + rr_len))
-            {
-              substr_len = (unsigned char)*strptr;
-              txt_curr->length += substr_len;
-              strptr += substr_len + 1;
-            }
-
-          /* Including null byte */
-          txt_curr->txt = malloc (txt_curr->length + 1);
+              txt_curr->length = substr_len;
+              txt_curr->txt = malloc (substr_len + 1/* Including null byte */);
               if (txt_curr->txt == NULL)
                 {
                   status = ARES_ENOMEM;
                   break;
                 }
+              memcpy ((char *) txt_curr->txt, strptr, substr_len);
+
+              /* Make sure we NULL-terminate */
+              txt_curr->txt[substr_len] = 0;
 
-          /* Step through the list of substrings, concatenating them */
-          str_len = 0;
-          strptr = aptr;
-          while (strptr < (aptr + rr_len))
-            {
-              substr_len = (unsigned char)*strptr;
-              strptr++;
-              memcpy ((char *) txt_curr->txt + str_len, strptr, substr_len);
-              str_len += substr_len;
               strptr += substr_len;
             }
-          /* Make sure we NULL-terminate */
-          *((char *) txt_curr->txt + txt_curr->length) = '\0';
         }
 
       /* Don't lose memory in the next iteration */