dxbjavid opened a new pull request, #13558: URL: https://github.com/apache/trafficserver/pull/13558
dns_process copies each answer record into the fixed HostEnt hostbuf while keeping a running buflen for the space left at the write cursor, but the branch that memcpys an A/AAAA address when the source is not word aligned advances the cursor by the alignment padding and the record length without decrementing buflen. Since every later name expansion hands that same buflen to dn_expand as its output limit, the stale, over-large value lets a crafted response (a large address record followed by a record whose owner name expands near the end of hostbuf) write the expanded name past the buffer and into the adjacent srv_hosts vector. This restores buflen from the cursor after the copy so it stays consistent, matching what the name, CNAME and PTR paths already do. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
