[musl] [PATCH v2] dns: check length field in tcp response message

[musl] [PATCH v2] dns: check length field in tcp response message

[Alexey Kodanev]

The received length field in the message may be greater than the
size of the 'answer' buffer in which the message resides. Currently,
ABUF_SIZE is 768. And if we get a larger 'alens[i]', it will result
in an out-of-bounds reading in __dns_parse().

To fix this, limit the length to the size of the received buffer.
---
v2: move the check to name_from_dns()

 src/network/lookup_name.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/network/lookup_name.c b/src/network/lookup_name.c
index 5f6867cb..e324f39d 100644
--- a/src/network/lookup_name.c
+++ b/src/network/lookup_name.c
@@ -179,6 +179,7 @@ static int name_from_dns(struct address buf[static MAXADDRS], char canon[static
 
 	for (i=nq-1; i>=0; i--) {
 		ctx.rrtype = qtypes[i];
+		if (alens[i] > sizeof(abuf[i])) alens[i] = sizeof(abuf[i]);
 		__dns_parse(abuf[i], alens[i], dns_parse_callback, &ctx);
 	}
 
-- 
2.25.1