We must copy the response buffer before fixing the packet length.
Otherwise the packet length will go wrong if the request contained
EDNS0 data.
---
 src/dnsproxy.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/dnsproxy.c b/src/dnsproxy.c
index 8366fa4..0578abf 100644
--- a/src/dnsproxy.c
+++ b/src/dnsproxy.c
@@ -1518,12 +1518,16 @@ static int cache_update(struct server_data *srv, 
unsigned char *msg,
         * two bytes. This way we do not need to know the format
         * (UDP/TCP) of the cached message.
         */
+       if (srv->protocol == IPPROTO_UDP)
+               memcpy(ptr + 2, msg, offset + 12);
+       else
+               memcpy(ptr, msg, offset + 12);
+
        ptr[0] = (data->data_len - 2) / 256;
        ptr[1] = (data->data_len - 2) - ptr[0] * 256;
        if (srv->protocol == IPPROTO_UDP)
                ptr += 2;
 
-       memcpy(ptr, msg, offset + 12);
        memcpy(ptr + offset + 12, question, qlen + 1); /* copy also the \0 */
 
        q = (void *) (ptr + offset + 12 + qlen + 1);
-- 
1.7.11.7

_______________________________________________
connman mailing list
[email protected]
http://lists.connman.net/listinfo/connman

Reply via email to