espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-18 08:29:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

[dns-client] avoid overflow in offset computation (#5464)

Browse Source
This commit is contained in:
Jonathan Hui
2020-08-28 11:48:28 -07:00
committed by GitHub
parent d3195e2a4f
commit 38e1fbed15
1 changed files with 12 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/net/dns_client.cpp
+12 -17
View File
@@ -443,7 +443,7 @@ void Client::HandleUdpReceive(Message &aMessage, const Ip6::MessageInfo &aMessag
// which it sent the corresponding query to.
OT_UNUSED_VARIABLE(aMessageInfo);
otError error = OT_ERROR_NONE;
otError error = OT_ERROR_NOT_FOUND;
Header responseHeader;
QueryMetadata queryMetadata;
ResourceRecordAaaa record;
@@ -469,29 +469,24 @@ void Client::HandleUdpReceive(Message &aMessage, const Ip6::MessageInfo &aMessag
// Parse and check the answer section.
for (uint32_t index = 0; index < responseHeader.GetAnswerCount(); index++)
{
uint32_t newOffset;
SuccessOrExit(error = SkipHostname(aMessage, offset));
if (offset + sizeof(ResourceRecord) > aMessage.GetLength())
VerifyOrExit(aMessage.Read(offset, sizeof(record), &record) == sizeof(record), error = OT_ERROR_PARSE);
if ((record.GetType() == ResourceRecordAaaa::kType) && (record.GetClass() == ResourceRecordAaaa::kClass))
{
ExitNow(error = OT_ERROR_PARSE);
// Return the first found IPv6 address.
FinalizeDnsTransaction(*message, queryMetadata, &record.GetAddress(), record.GetTtl(), OT_ERROR_NONE);
ExitNow(error = OT_ERROR_NONE);
}
if (aMessage.Read(offset, sizeof(record), &record) != sizeof(record) ||
record.GetType() != ResourceRecordAaaa::kType || record.GetClass() != ResourceRecordAaaa::kClass)
{
offset += sizeof(ResourceRecord) + record.GetLength();
continue;
}
// Return the first found IPv6 address.
FinalizeDnsTransaction(*message, queryMetadata, &record.GetAddress(), record.GetTtl(), OT_ERROR_NONE);
ExitNow();
newOffset = offset + sizeof(ResourceRecord) + record.GetLength();
VerifyOrExit(newOffset <= aMessage.GetLength(), error = OT_ERROR_PARSE);
offset = static_cast<uint16_t>(newOffset);
}
ExitNow(error = OT_ERROR_NOT_FOUND);
exit:
if (message != nullptr && error != OT_ERROR_NONE)