Aksal/nuttx
3
1
Fork 1
mirror of https://github.com/apache/nuttx.git synced 2026-08-01 20:28:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

libs/netdb: Fix dns_recv_response() to dns_answer_s size

Browse source 
This commit avoid that dns_recv_response() accepts fewer tha 10 bytes
that could end up with an OOB read.

Signed-off-by: Alan C. Assis <acassis@gmail.com>
This commit is contained in:
Alan Carvalho de Assis 2026-05-03 11:01:32 -03:00 • committed by Alan C. Assis
parent 96041a7c58
commit 805169cebd
1 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
libs/libc/netdb/lib_dnsquery.c
View file

@ -694,6 +694,19 @@ static int dns_recv_response(int sd, FAR union dns_addr_u *addr, int naddr,
break;
}
/* Verify that a complete answer header (10 bytes: type, class,
* ttl[2], len) is available before casting to dns_answer_s.
* Without this check, accessing ans->ttl and ans->type/class/len
* would be an OOB read if fewer than 10 bytes remain.
*/
if (nameptr + sizeof(struct dns_answer_s) > endofbuffer)
{
ret = -EILSEQ;
nwarn("DNS answer header truncated\n");
break;
}
ans = (FAR struct dns_answer_s *)nameptr;
ninfo("Answer: type=%04x, class=%04x, ttl=%06x, length=%04x\n",