diff mbox series

[3/4] resolv: Fix __libc_res_queriesmatch buffer size argument in send_dg (bug 34346)

Message ID 99ad4d202644810ba322af9edec713f60f23fb3e.1783089265.git.fweimer@redhat.com (mailing list archive)
State New
Headers
Series resolv: Fixing slight buffer misuse in send_dg |

Checks

Context Check Description
redhat-pt-bot/TryBot-apply_patch success Patch applied to master at the time it was sent
linaro-tcwg-bot/tcwg_glibc_build--master-arm success Build passed
linaro-tcwg-bot/tcwg_glibc_build--master-aarch64 success Build passed
linaro-tcwg-bot/tcwg_glibc_check--master-aarch64 fail Test failed
linaro-tcwg-bot/tcwg_glibc_check--master-arm success Test passed

Commit Message

Florian Weimer July 3, 2026, 2:53 p.m. UTC 
  Pass the number of bytes written by recvfrom, not the entire size
of the buffer.

This is not a security vulnerability because it only allows
confirmation of previously existing buffer values.  All reads stay
within the specified buffer bounds.  The buffer contents may not have
been initialized.  Subsequent processing is correctly capped at buffer
bounds, too.
---
 resolv/res_send.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/resolv/res_send.c b/resolv/res_send.c
index cf27fa7ad6..cc65a03e7d 100644
--- a/resolv/res_send.c
+++ b/resolv/res_send.c
@@ -1215,14 +1215,14 @@  send_dg(res_state statp,
 		    && (skip_query_match
 			|| __libc_res_queriesmatch (buf, buf + buflen,
 						    *thisansp,
-						    *thisansp + *thisanssizp)))
+						    *thisansp + *thisresplenp)))
 		  matching_query = 1;
 		if (!recvresp2
 		    && anhp->id == hp2->id
 		    && (skip_query_match
 			|| __libc_res_queriesmatch (buf2, buf2 + buflen2,
 						    *thisansp,
-						    *thisansp + *thisanssizp)))
+						    *thisansp + *thisresplenp)))
 		  matching_query = 2;
 		if (matching_query == 0)
 		  /* Spurious UDP packet.  Drop it and continue