Android-x86
Forkbionic
| Révision | 2820a9770e73253cf0d2311783c12b1d34c05c06 (tree) |
|---|---|
| l'heure | 2020-08-30 15:01:55 |
| Auteur | Ken Chen <cken@goog...> |
| Commiter | Automerger Merge Worker |
Fix OOB read in DNS resolver am: 43264bc365 am: c5ea7569a8 am: 2c2546b158 am: cf6b3ecd4d
Original change: https://googleplex-android-review.googlesource.com/c/platform/bionic/+/12329970
Change-Id: I8a4388a793a26fb246529165c3e6338115cdaff9
libc/dns/resolv/res_send.c (diff)| @@ -948,6 +948,8 @@ send_vc(res_state statp, struct __res_params* params, | ||
| 948 | 948 | else |
| 949 | 949 | break; |
| 950 | 950 | } |
| 951 | + // return size should never exceed container size | |
| 952 | + resplen = anssiz; | |
| 951 | 953 | } |
| 952 | 954 | /* |
| 953 | 955 | * If the calling applicating has bailed out of |
| @@ -960,7 +962,7 @@ send_vc(res_state statp, struct __res_params* params, | ||
| 960 | 962 | DprintQ((statp->options & RES_DEBUG) || |
| 961 | 963 | (statp->pfcode & RES_PRF_REPLY), |
| 962 | 964 | (stdout, ";; old answer (unexpected):\n"), |
| 963 | - ans, (resplen > anssiz) ? anssiz: resplen); | |
| 965 | + ans, resplen); | |
| 964 | 966 | goto read_len; |
| 965 | 967 | } |
| 966 | 968 |
