NetworkPkg/DnsDxe: Bound query name length in ParseDnsResponse

ParseDnsResponse() computes the query name length with AsciiStrLen on
bytes taken straight from the received UDP datagram, before any bounds
check. AsciiStrLen has no length cap in RELEASE builds, so a response
whose question-name field carries no terminating zero makes the scan
read past the end of the packet buffer returned by NetbufGetByte, an
out-of-bounds read driven by attacker-controlled network input.

Bound the scan with AsciiStrnLenS limited to RemainingLength, the bytes
available from the name onward. The existing RemainingLength check then
rejects a name that never terminates, which also makes the later
AsciiStrLen(QueryName) uses provably in-bounds.

Signed-off-by: Syed Mohammed Nayyar <jmestwa@gmail.com>

0 files changed, 0 insertions, 0 deletions