Commit 0f1d7d3b authored May 12, 2025 by Jordan Yates Committed by Benjamin Cabé May 14, 2025

net: dns: dispatcher: fix OOB array access

Validate that the file descriptor is not a negative number before
writing to the `dispatch_table` `ctx` field. Setting file descriptors
to `-1` is the standard "not in use" value, and in fact the entire array
of `fds` is set to this value in `dns_resolve_init_locked`. This
resolves memory corruption of whichever variable is unfortunate to exist
just before `dispatch_table` in memory.

Signed-off-by: Jordan Yates <jordan@embeint.com>

parent 2e484fc6

subsys/net/lib/dns/dispatcher.c

+4 −0

Changes for subsys/net/lib/dns/dispatcher.c: 4 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -345,6 +345,10 @@ int dns_dispatcher_unregister(struct dns_socket_dispatcher *ctx)
		goto out;
		}

		if (ctx->fds[i].fd < 0) {
		continue;
		}

		dispatch_table[ctx->fds[i].fd].ctx = NULL;
		}

Admin message