| commit | 77327ed064bd57b0e1865cd0e0364057ff4a53b4 | [log] [tgz] |
|---|---|---|
| author | Alexey Kodanev <[email protected]> | Wed Mar 22 17:48:40 2023 +0300 |
| committer | Rich Felker <[email protected]> | Fri Apr 07 20:44:20 2023 -0400 |
| tree | 456aa3bfdc5ff2c84c5e1eb68bf49002d386adf3 | |
| parent | 1d5750b95c06913a1f18a995481276d698d20fae [diff] |
dns: check length field in tcp response message The received length field in the message may be greater than the size of the 'answer' buffer in which the message resides. Currently, ABUF_SIZE is 768. And if we get a larger 'alens[i]', it will result in an out-of-bounds reading in __dns_parse(). To fix this, limit the length to the size of the received buffer.