tree 609d5dc9d969c0c0db80d68d9613aa4ed3701fca
parent c966227cf118eabc30901ab89bfa24cc2fbe346a
author Ken Chen <cken@google.com> 1596086656 +0800
committer android-build-team Robot <android-build-team-robot@google.com> 1600298955 +0000

Fix OOB read in DNS resolver

The remote server specifies resplen, the length of the response it
intends to send. anssiz represents the size of the destination buffer.
If the reported resplen is larger than the anssiz, the code correctly
only reads up to anssiz bytes, but returns resplen. so later functions
will access far out of bounds.

The fix ensures that the length of send_vc return does not exceed the
buffer size.

Bug: 161362564
Test: atest pass on HWAddressSanitizer build.
Merged-In: Id4b5df1be4652e4623847b0b0bad0af65b80fdd5
Change-Id: Id4b5df1be4652e4623847b0b0bad0af65b80fdd5
(cherry picked from commit cf6ee247113426ef4e7365a86d00bb5430186802)
(cherry picked from commit 5214c6bebaadfe307579ee930fc650235b157192)