net: dns: OOB memory write

[JordanYates]

Describe the bug

An out-of-bounds memory write occurs whenever dns_dispatcher_unregister comes across a file descriptor with a negative number. All file descriptors are initialised to -1 in dns_resolve_init_locked.

Expected behavior

No OOB write should occur.

Impact

Whichever variable is assigned to the memory just before dispatch_table has memory erroneously set to 0 whenever dns_dispatcher_unregister runs.

Environment (please complete the following information):

• Zephyr 4.1

[jukkar]

Already merged -> closing

[mkaranki]

Hi,

While checking other issue with 3.7, I stumbled on this one.

In v3.7 branch, there is no check of fd being -1. Ref:

zephyr/subsys/net/lib/dns/dispatcher.c

Line 301 in 5e6962c

dispatch_table[ctx->fds[i].fd].ctx = NULL;

... But fd is initialized to -1 as well in Zephyr 3.7:

zephyr/subsys/net/lib/dns/resolve.c

Line 359 in 5e6962c

ctx->fds[j].fd = -1;

So I wonder should d this be backported to 3.7 too?