Skip to content

[Backport v3.7-branch] net: dns: Fix potential buffer overflow when unpacking labels #99900

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: v3.7-branch
Choose a base branch
from
+3 −3
Open

[Backport v3.7-branch] net: dns: Fix potential buffer overflow when unpacking labels #99900

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions subsys/net/lib/dns/dns_pack.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -479,10 +479,9 @@
}

/* Returns the length of the unpacked name */
static int dns_unpack_name(const uint8_t *msg, int maxlen, const uint8_t *src,

Check failure on line 482 in subsys/net/lib/dns/dns_pack.c

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Refactor this function to reduce its Cognitive Complexity from 28 to the 25 allowed. 


See more on https://sonarcloud.io/project/issues?id=zephyrproject-rtos_zephyr&issues=AZq1jWGAu09CkqfykYKL&open=AZq1jWGAu09CkqfykYKL&pullRequest=99900
struct net_buf *buf, const uint8_t **eol)
{
int dest_size = net_buf_tailroom(buf);
const uint8_t *end_of_label = NULL;
const uint8_t *curr_src = src;
int loop_check = 0, len = -1;
Expand Down Expand Up @@ -521,6 +520,8 @@
return -EMSGSIZE;
}
} else {
size_t dest_size = net_buf_tailroom(buf);

/* Max label length is 64 bytes (because 2 bits are
* used for pointer)
*/
Expand All @@ -529,8 +530,7 @@
return -EMSGSIZE;
}

if (((buf->data + label_len + 1) >=
(buf->data + dest_size)) ||
if ((label_len + 1 >= dest_size) ||
((curr_src + label_len) >= (msg + maxlen))) {
return -EMSGSIZE;
}
Expand Down
Loading