projects / musl / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 1d5750b) | patch
dns: check length field in tcp response message
authorAlexey Kodanev <aleksei.kodanev@bell-sw.com>
Wed, 22 Mar 2023 14:48:40 +0000 (17:48 +0300)
committerRich Felker <dalias@aerifal.cx>
Sat, 8 Apr 2023 00:44:20 +0000 (20:44 -0400)
commit77327ed064bd57b0e1865cd0e0364057ff4a53b4
tree456aa3bfdc5ff2c84c5e1eb68bf49002d386adf3tree | snapshot
parent1d5750b95c06913a1f18a995481276d698d20faecommit | diff
dns: check length field in tcp response message

The received length field in the message may be greater than the
size of the 'answer' buffer in which the message resides. Currently,
ABUF_SIZE is 768. And if we get a larger 'alens[i]', it will result
in an out-of-bounds reading in __dns_parse().

To fix this, limit the length to the size of the received buffer.
src/network/lookup_name.c diff | blob | history
musl