Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 11ad8ac8 authored by Ken Chen's avatar Ken Chen
Browse files

Fix OOB read in DNS resolver

The remote server specifies resplen, the length of the response it
intends to send. anssiz represents the size of the destination buffer.
If the reported resplen is larger than the anssiz, the code correctly
only reads up to anssiz bytes, but returns resplen. so later functions
will access far out of bounds.

The fix ensures that the length of send_vc return does not exceed the
buffer size.

(Manually backport commit from ag/12280247, since it's different git
project on qt-dev. Use aosp/1302595 as Merged-In tag to avoid conflict)

Bug: 161362564
Test: atest pass
Change-Id: Id4b5df1be4652e4623847b0b0bad0af65b80fdd5
Merged-In: I1ff2dc09f41f76973c5f066b07b15388e722b375
parent 3f47223f
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment