diff --git a/libc/dns/resolv/res_cache.c b/libc/dns/resolv/res_cache.c
index 02887f2..212ee0a 100644
--- a/libc/dns/resolv/res_cache.c
+++ b/libc/dns/resolv/res_cache.c
@@ -2230,10 +2230,16 @@
             stats[i] = info->nsstats[i];
         }
         for (i = 0; i < MAXDNSRCH; i++) {
-            if (info->dnsrch_offset[i] == -1) {
+            const char* cur_domain = info->defdname + info->dnsrch_offset[i];
+            // dnsrch_offset[i] can either be -1 or point to an empty string to indicate the end
+            // of the search offsets. Checking for < 0 is not strictly necessary, but safer.
+            // TODO: Pass in a search domain array instead of a string to
+            // _resolv_set_nameservers_for_net() and make this double check unnecessary.
+            if (info->dnsrch_offset[i] < 0 ||
+                    ((size_t)info->dnsrch_offset[i]) >= sizeof(info->defdname) || !cur_domain[0]) {
                 break;
             }
-            strlcpy(domains[i], info->defdname + info->dnsrch_offset[i], MAXDNSRCHPATH);
+            strlcpy(domains[i], cur_domain, MAXDNSRCHPATH);
         }
         *dcount = i;
         *params = info->params;