ulDNSHandlePacket() - check length before calculating payload size (#…

…1615)

libraries/freertos_plus/standard/freertos_plus_tcp/source/FreeRTOS_DNS.c

@@ -916,18 +916,25 @@ for testing purposes, by the module iot_test_freertos_tcp.c
 uint32_t ulDNSHandlePacket( NetworkBufferDescriptor_t *pxNetworkBuffer )
 {
 DNSMessage_t *pxDNSMessageHeader;
-size_t uxPayloadSize = pxNetworkBuffer->xDataLength - sizeof( UDPPacket_t );
-
-	if( uxPayloadSize >= sizeof( DNSMessage_t ) )
-	{
-		pxDNSMessageHeader =
-			( DNSMessage_t * ) ( pxNetworkBuffer->pucEthernetBuffer + sizeof( UDPPacket_t ) );
-
-		/* The parameter pdFALSE indicates that the reply was not expected. */
-		prvParseDNSReply( ( uint8_t * ) pxDNSMessageHeader,
-						  uxPayloadSize,
-						  pdFALSE );
-	}
+size_t uxPayloadSize;
+
+    /* Only proceed if the payload length indicated in the header
+    appears to be valid. */
+    if( pxNetworkBuffer->xDataLength >= sizeof( UDPPacket_t ) )
+    {
+        uxPayloadSize = pxNetworkBuffer->xDataLength - sizeof( UDPPacket_t );
+
+        if( uxPayloadSize >= sizeof( DNSMessage_t ) )
+        {
+            pxDNSMessageHeader =
+                ( DNSMessage_t * ) ( pxNetworkBuffer->pucEthernetBuffer + sizeof( UDPPacket_t ) );
+
+            /* The parameter pdFALSE indicates that the reply was not expected. */
+            prvParseDNSReply( ( uint8_t * ) pxDNSMessageHeader,
+                uxPayloadSize,
+                pdFALSE );
+        }
+    }
 
 	/* The packet was not consumed. */
 	return pdFAIL;