Summary
The function dns_copy_qname in dns_pack.c performs performs a memcpy operation with an
untrusted field and does not check if the source buffer is large enough to contain the copied
data.
Details
The dns_copy_qname function contains a memcpy operation in line 403. The lb_size argument is read from the packet in line 377.
The function only validates the destination buffer in line 397 to ensure the buffer is large enough to contain the expected data. However, there is no validation for the source buffer.
Impact
For embedded devices with memory protection, this out-of-bound read can cause a crash and a
denial of service. For devices without memory protection, this can lead to incorrect and unexpected behaviors.
Fix Recommendation
In the target function, we can correct the size check condition (line 397) to prevent these reads from occurring. We can change the condition in line 397 to:
DNS_LABEL_LEN_SIZE + lb_size > MIN(size - *len, msg_size - pos)
Patches
main: #82072
v4.0.0: #82289
v3.7.0: #82288
For more information
If you have any questions or comments about this advisory:
embargo: 2025-02-13
AmPaschal Reporter
Summary
The function
dns_copy_qnamein dns_pack.c performs performs a memcpy operation with anuntrusted field and does not check if the source buffer is large enough to contain the copied
data.
Details
The
dns_copy_qnamefunction contains a memcpy operation in line 403. Thelb_sizeargument is read from the packet in line 377.The function only validates the destination buffer in line 397 to ensure the buffer is large enough to contain the expected data. However, there is no validation for the source buffer.
Impact
For embedded devices with memory protection, this out-of-bound read can cause a crash and a
denial of service. For devices without memory protection, this can lead to incorrect and unexpected behaviors.
Fix Recommendation
In the target function, we can correct the size check condition (line 397) to prevent these reads from occurring. We can change the condition in line 397 to:
Patches
main: #82072
v4.0.0: #82289
v3.7.0: #82288
For more information
If you have any questions or comments about this advisory:
embargo: 2025-02-13