Android-x86
Forkbionic
| Revision | c5ea7569a80468665fd80ff3f987dd5ca5d2e7e1 (tree) |
|---|---|
| Time | 2020-08-30 13:49:07 |
| Author | Ken Chen <cken@goog...> |
| Commiter | Automerger Merge Worker |
Fix OOB read in DNS resolver am: 43264bc365
Original change: https://googleplex-android-review.googlesource.com/c/platform/bionic/+/12329970
Change-Id: Ief989a779e7fea19a92fb90a863017ecdb1bc7a3
libc/dns/resolv/res_send.c (diff)| @@ -948,6 +948,8 @@ send_vc(res_state statp, struct __res_params* params, | ||
| 948 | 948 | else |
| 949 | 949 | break; |
| 950 | 950 | } |
| 951 | + // return size should never exceed container size | |
| 952 | + resplen = anssiz; | |
| 951 | 953 | } |
| 952 | 954 | /* |
| 953 | 955 | * If the calling applicating has bailed out of |
| @@ -960,7 +962,7 @@ send_vc(res_state statp, struct __res_params* params, | ||
| 960 | 962 | DprintQ((statp->options & RES_DEBUG) || |
| 961 | 963 | (statp->pfcode & RES_PRF_REPLY), |
| 962 | 964 | (stdout, ";; old answer (unexpected):\n"), |
| 963 | - ans, (resplen > anssiz) ? anssiz: resplen); | |
| 965 | + ans, resplen); | |
| 964 | 966 | goto read_len; |
| 965 | 967 | } |
| 966 | 968 |
