Browse Source

net: dns: Check DNS answer properly

The dns_unpack_answer() did not check the length of the message
properly which can cause out of bounds read.

Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
pull/82392/head
Jukka Rissanen 7 months ago committed by Chris Friedt
parent
commit
9f80f32bb3
  1. 2
      subsys/net/lib/dns/dns_pack.c

2
subsys/net/lib/dns/dns_pack.c

@ -134,7 +134,7 @@ int dns_unpack_answer(struct dns_msg_t *dns_msg, int dname_ptr, uint32_t *ttl, @@ -134,7 +134,7 @@ int dns_unpack_answer(struct dns_msg_t *dns_msg, int dname_ptr, uint32_t *ttl,
*
* See RFC-1035 4.1.3. Resource record format
*/
rem_size = dns_msg->msg_size - dname_len;
rem_size = dns_msg->msg_size - dns_msg->answer_offset - dname_len;
if (rem_size < 2 + 2 + 4 + 2) {
return -EINVAL;
}

Loading…
Cancel
Save