From 6bcc543535e2d28f8062ced96e6a4338ed615b42 Mon Sep 17 00:00:00 2001 From: jmestwa-coder Date: Tue, 26 May 2026 17:06:27 +0530 Subject: [PATCH] NetworkPkg/DnsDxe: Bound query name length in ParseDnsResponse ParseDnsResponse() computes the query name length with AsciiStrLen on bytes taken straight from the received UDP datagram, before any bounds check. AsciiStrLen has no length cap in RELEASE builds, so a response whose question-name field carries no terminating zero makes the scan read past the end of the packet buffer returned by NetbufGetByte, an out-of-bounds read driven by attacker-controlled network input. Bound the scan with AsciiStrnLenS limited to RemainingLength, the bytes available from the name onward. The existing RemainingLength check then rejects a name that never terminates, which also makes the later AsciiStrLen(QueryName) uses provably in-bounds. Signed-off-by: Syed Mohammed Nayyar --- NetworkPkg/DnsDxe/DnsImpl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/NetworkPkg/DnsDxe/DnsImpl.c b/NetworkPkg/DnsDxe/DnsImpl.c index f7581e205d..ad8b4daead 100644 --- a/NetworkPkg/DnsDxe/DnsImpl.c +++ b/NetworkPkg/DnsDxe/DnsImpl.c @@ -1218,7 +1218,7 @@ ParseDnsResponse ( // QueryName = (CHAR8 *)(RxString + sizeof (*DnsHeader)); - QueryNameLen = (UINT32)AsciiStrLen (QueryName) + 1; + QueryNameLen = (UINT32)AsciiStrnLenS (QueryName, RemainingLength) + 1; // // Check whether the remaining packet length is available or not.