From 9b132e556774c744f9052581d2d8d0fab417e97c Mon Sep 17 00:00:00 2001 From: Alexey Izbyshev Date: Sun, 29 Jan 2023 19:46:51 +0300 Subject: prevent CNAME/PTR parsing from reading data past the response end DNS parsing callbacks pass the response buffer end instead of the actual response end to dn_expand, so a malformed DNS response can use message compression to make dn_expand jump past the response end and attempt to parse uninitialized parts of that buffer, which might succeed and return garbage. --- src/network/lookup.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/network/lookup.h') diff --git a/src/network/lookup.h b/src/network/lookup.h index ef662725..54b2f8b5 100644 --- a/src/network/lookup.h +++ b/src/network/lookup.h @@ -50,6 +50,6 @@ hidden int __lookup_ipliteral(struct address buf[static 1], const char *name, in hidden int __get_resolv_conf(struct resolvconf *, char *, size_t); hidden int __res_msend_rc(int, const unsigned char *const *, const int *, unsigned char *const *, int *, int, const struct resolvconf *); -hidden int __dns_parse(const unsigned char *, int, int (*)(void *, int, const void *, int, const void *), void *); +hidden int __dns_parse(const unsigned char *, int, int (*)(void *, int, const void *, int, const void *, int), void *); #endif -- cgit v1.2.3