Fix OOB read in DNS resolver
The remote server specifies resplen, the length of the response it intends to send. anssiz represents the size of the destination buffer. If the reported resplen is larger than the anssiz, the code correctly only reads up to anssiz bytes, but returns resplen. so later functions will access far out of bounds. The fix ensures that the length of send_vc return does not exceed the buffer size. Bug: 161362564 Test: atest pass on HWAddressSanitizer build. Merged-In: Id4b5df1be4652e4623847b0b0bad0af65b80fdd5 Change-Id: Id4b5df1be4652e4623847b0b0bad0af65b80fdd5 (cherry picked from commit cf6ee247) (cherry picked from commit 5214c6be)
Loading
Please register or sign in to comment