From 09e06c6eff947fa44d417fd7311c52a6ca9add7f Mon Sep 17 00:00:00 2001 From: Jonathan Hui Date: Mon, 10 Oct 2022 11:45:39 -0700 Subject: [PATCH] [dns-types] verify pointer refers to prior occurrence (#8262) --- src/core/net/dns_types.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/core/net/dns_types.cpp b/src/core/net/dns_types.cpp index eff5f73eb..04cefcb8d 100644 --- a/src/core/net/dns_types.cpp +++ b/src/core/net/dns_types.cpp @@ -522,6 +522,7 @@ Error Name::LabelIterator::GetNextLabel(void) // specify an offset value from the start of the DNS header. uint16_t pointerValue; + uint16_t nextLabelOffset; SuccessOrExit(error = mMessage.Read(mNextLabelOffset, pointerValue)); @@ -532,7 +533,9 @@ Error Name::LabelIterator::GetNextLabel(void) // `mMessage.GetOffset()` must point to the start of the // DNS header. - mNextLabelOffset = mMessage.GetOffset() + (HostSwap16(pointerValue) & kPointerLabelOffsetMask); + nextLabelOffset = mMessage.GetOffset() + (HostSwap16(pointerValue) & kPointerLabelOffsetMask); + VerifyOrExit(nextLabelOffset < mNextLabelOffset, error = kErrorParse); + mNextLabelOffset = nextLabelOffset; // Go back through the `while(true)` loop to get the next label. }