uefi-ref/edk2
1
0
Fork 0
mirror of https://github.com/tianocore/edk2 synced 2026-08-27 00:23:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

NetworkPkg/DnsDxe: Bound query name length in ParseDnsResponse

Browse source 
ParseDnsResponse() computes the query name length with AsciiStrLen on
bytes taken straight from the received UDP datagram, before any bounds
check. AsciiStrLen has no length cap in RELEASE builds, so a response
whose question-name field carries no terminating zero makes the scan
read past the end of the packet buffer returned by NetbufGetByte, an
out-of-bounds read driven by attacker-controlled network input.

Bound the scan with AsciiStrnLenS limited to RemainingLength, the bytes
available from the name onward. The existing RemainingLength check then
rejects a name that never terminates, which also makes the later
AsciiStrLen(QueryName) uses provably in-bounds.

Signed-off-by: Syed Mohammed Nayyar <jmestwa@gmail.com>
This commit is contained in:
jmestwa-coder 2026-05-26 17:06:27 +05:30 • committed by “rootvector2”
parent 7735ed4f8e
commit 6bcc543535
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
NetworkPkg/DnsDxe/DnsImpl.c
View file

@ -1218,7 +1218,7 @@ ParseDnsResponse (
//
QueryName = (CHAR8 *)(RxString + sizeof (*DnsHeader));
QueryNameLen = (UINT32)AsciiStrLen (QueryName) + 1;
QueryNameLen = (UINT32)AsciiStrnLenS (QueryName, RemainingLength) + 1;
//
// Check whether the remaining packet length is available or not.