diff mbox series

[1/4] support: Add resolv_response_set_buffer

Message ID da99017797e4be1e2d6516e2430e97d55558e5f5.1783089265.git.fweimer@redhat.com (mailing list archive)
State New
Headers
Series resolv: Fixing slight buffer misuse in send_dg |

Checks

Context Check Description
redhat-pt-bot/TryBot-apply_patch success Patch applied to master at the time it was sent
linaro-tcwg-bot/tcwg_glibc_build--master-arm success Build passed
linaro-tcwg-bot/tcwg_glibc_build--master-aarch64 success Build passed
linaro-tcwg-bot/tcwg_glibc_check--master-aarch64 success Test passed
linaro-tcwg-bot/tcwg_glibc_check--master-arm success Test passed

Commit Message

Florian Weimer July 3, 2026, 2:52 p.m. UTC 
  This can be used to mangle the response data to exercise the
DNS client with corrupted packets.

Also change resolv_response_buffer not to allocate.  Instead,
just return a pointer to the internal buffer.  The function is
currently unused.
---
 support/resolv_test.c | 17 +++++++++++++----
 support/resolv_test.h | 15 +++++++++++++++
 2 files changed, 28 insertions(+), 4 deletions(-)
diff mbox series

Patch

diff --git a/support/resolv_test.c b/support/resolv_test.c
index ec406b281a..4bb642f439 100644
--- a/support/resolv_test.c
+++ b/support/resolv_test.c
@@ -429,11 +429,20 @@  resolv_response_length (const struct resolv_response_builder *b)
 }
 
 unsigned char *
-resolv_response_buffer (const struct resolv_response_builder *b)
+resolv_response_buffer (struct resolv_response_builder *b)
 {
-  unsigned char *result = xmalloc (b->offset);
-  memcpy (result, b->buffer, b->offset);
-  return result;
+  return b->buffer;
+}
+
+void
+resolv_response_set_buffer (struct resolv_response_builder *b,
+                            const unsigned char *data, size_t length)
+{
+  if (length > max_response_length)
+    FAIL_EXIT1 ("resolv_response_set_buffer: length %zu exceeds maximum %d",
+                length, max_response_length);
+  memmove (b->buffer, data, length);
+  b->offset = length;
 }
 
 struct resolv_response_builder *
diff --git a/support/resolv_test.h b/support/resolv_test.h
index 7a81c1c513..c10c523eb4 100644
--- a/support/resolv_test.h
+++ b/support/resolv_test.h
@@ -206,6 +206,21 @@  void resolv_response_close (struct resolv_response_builder *);
 /* The size of the response packet built so far.  */
 size_t resolv_response_length (const struct resolv_response_builder *);
 
+/* Return a pointer to the internal response buffer.  The pointer is
+   only valid until the next call that modifies the builder.  The
+   length of the byte array can be obtained using
+   resolv_response_length.  */
+unsigned char *resolv_response_buffer (struct resolv_response_builder *)
+  __attribute_nonnull__ ((1));
+
+/* Replace the contents of the response buffer contents with a copy of
+   LENGTH bytes starting at DATA.  Passing the pointer returned by
+   resolv_response_buffer is valid.  If LENGTH is larger than the
+   maximum support packet size, fail the process.  */
+void resolv_response_set_buffer (struct resolv_response_builder *,
+                                 const unsigned char *data, size_t length)
+  __attribute_nonnull__ ((1, 2));
+
 /* Allocates a response builder tied to a specific query packet,
    starting at QUERY_BUFFER, containing QUERY_LENGTH bytes.  */
 struct resolv_response_builder *