dns: check length field in tcp response message
authorAlexey Kodanev <aleksei.kodanev@bell-sw.com>
Wed, 22 Mar 2023 14:48:40 +0000 (17:48 +0300)
committerRich Felker <dalias@aerifal.cx>
Sat, 8 Apr 2023 00:44:20 +0000 (20:44 -0400)
The received length field in the message may be greater than the
size of the 'answer' buffer in which the message resides. Currently,
ABUF_SIZE is 768. And if we get a larger 'alens[i]', it will result
in an out-of-bounds reading in __dns_parse().

To fix this, limit the length to the size of the received buffer.


No differences found