Branch: refs/heads/master
Home: https://github.com/tianocore/edk2
Commit: 4f9b239a60d51b89622b2a7ca9d5cbe3de86a4ad
https://github.com/tianocore/edk2/commit/4f9b239a60d51b89622b2a7ca9d5cbe3de86a4ad
Author: jmestwa-coder <[email protected]>
Date: 2026-09-29 (Tue, 29 Sep 2026)
Changed paths:
M NetworkPkg/DnsDxe/DnsImpl.c
Log Message:
-----------
NetworkPkg/DnsDxe: Bound query name length in ParseDnsResponse
ParseDnsResponse() computes the query name length with AsciiStrLen on
bytes taken straight from the received UDP datagram, before any bounds
check. AsciiStrLen has no length cap in RELEASE builds, so a response
whose question-name field carries no terminating zero makes the scan
read past the end of the packet buffer returned by NetbufGetByte, an
out-of-bounds read driven by attacker-controlled network input.
Bound the scan with AsciiStrnLenS limited to RemainingLength, the bytes
available from the name onward. The existing RemainingLength check then
rejects a name that never terminates, which also makes the later
AsciiStrLen(QueryName) uses provably in-bounds.
Signed-off-by: Syed Mohammed Nayyar <[email protected]>
To unsubscribe from these emails, change your notification settings at
https://github.com/tianocore/edk2/settings/notifications
_______________________________________________
edk2-commits mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/edk2-commits
