/***************************************************************************/ /* Copyright (c) 2024 Microsoft Corporation */ /* Copyright (c) 2026 Eclipse ThreadX contributors */ /* */ /* This program and the accompanying materials are made available under */ /* the terms of the MIT License which is available at */ /* https://opensource.org/licenses/MIT. */ /* */ /* SPDX-License-Identifier: MIT */ /***************************************************************************/ /* A valid DNS response packet 00000000: 1c1a dfb0 2f0a 74b6 b640 932d 0800 4500 ..../.t..@.-..E. 00000010: 0069 725d 0000 4011 80a6 c0a8 01fe c0a8 .ir]..@......... 00000020: 0432 0035 c8e1 0055 4c59 88cc 8180 0001 .2.5...ULY...... 00000030: 0002 0000 0000 0863 6c69 656e 7473 3406 .......clients4. 00000040: 676f 6f67 6c65 0363 6f6d 0000 0100 01c0 google.com...... 00000050: 0c00 0500 0100 0000 c300 0c07 636c 6965 ............clie 00000060: 6e74 7301 6cc0 15c0 3100 0100 0100 0001 nts.l...1....... 00000070: 2c00 04ac d903 ce ,...... Domain Name System (response) Transaction ID: 0x88cc Flags: 0x8180 Standard query response, No error Questions: 1 Answer RRs: 2 Authority RRs: 0 Additional RRs: 0 Queries clients4.google.com: type A, class IN Name: clients4.google.com [Name Length: 19] [Label Count: 3] Type: A (Host Address) (1) Class: IN (0x0001) Answers clients4.google.com: type CNAME, class IN, cname clients.l.google.com Name: clients4.google.com Type: CNAME (Canonical NAME for an alias) (5) Class: IN (0x0001) Time to live: 195 (3 minutes, 15 seconds) Data length: 12 CNAME: clients.l.google.com clients.l.google.com: type A, class IN, addr 172.217.3.206 Name: clients.l.google.com Type: A (Host Address) (1) Class: IN (0x0001) Time to live: 300 (5 minutes) Data length: 4 Address: 172.217.3.206 [Unsolicited: True] */ /* Invalid response packet 0 */ /* where CNAME lableSize 0xc0 (the 80th Byte) is changed to 0x3e, which leads to name buffer OOB in _nx_dns_name_size_calculate(), then is detected.*/ char invalid_response_ptr_0[119] = { 0x1c, 0x1a, 0xdf, 0xb0, 0x2f, 0x0a, 0x74, 0xb6, 0xb6, 0x40, 0x93, 0x2d, 0x08, 0x00, 0x45, 0x00, 0x00, 0x69, 0x72, 0x5d, 0x00, 0x00, 0x40, 0x11, 0x80, 0xa6, 0xc0, 0xa8, 0x01, 0xfe, 0xc0, 0xa8, 0x04, 0x32, 0x00, 0x35, 0xc8, 0xe1, 0x00, 0x55, 0x4c, 0x59, 0x88, 0xcc, 0x81, 0x80, 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x34, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x3e, 0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x00, 0x00, 0xc3, 0x00, 0x0c, 0x07, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x01, 0x6c, 0xc0, 0x15, 0xc0, 0x31, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x2c, 0x00, 0x04, 0xac, 0xd9, 0x03, 0xce }; unsigned int invalid_response_size_0 = 119; /* Invalid response packet 1 */ /* where question lableSize 0x08 (the 55th byte) is changed to 0x3e, which leads to name buffer OOB in _nx_dns_name_size_calculate(), then is detected.*/ char invalid_response_ptr_1[119] = { 0x1c, 0x1a, 0xdf, 0xb0, 0x2f, 0x0a, 0x74, 0xb6, 0xb6, 0x40, 0x93, 0x2d, 0x08, 0x00, 0x45, 0x00, 0x00, 0x69, 0x72, 0x5d, 0x00, 0x00, 0x40, 0x11, 0x80, 0xa6, 0xc0, 0xa8, 0x01, 0xfe, 0xc0, 0xa8, 0x04, 0x32, 0x00, 0x35, 0xc8, 0xe1, 0x00, 0x55, 0x4c, 0x59, 0x88, 0xcc, 0x81, 0x80, 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x3e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x34, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x3e, 0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x00, 0x00, 0xc3, 0x00, 0x0c, 0x07, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x01, 0x6c, 0xc0, 0x15, 0xc0, 0x31, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x2c, 0x00, 0x04, 0xac, 0xd9, 0x03, 0xce }; unsigned int invalid_response_size_1 = 119; /* Invalid response packet 2 */ /* where A address lableSize 0xc0 (the 104th Byte) is changed to 0x0d, the 117th Byte is changed to 0, which leads to buffer OOB in _nx_dns_resource_type_get(), then is detected. */ char invalid_response_ptr_2[119] = { 0x1c, 0x1a, 0xdf, 0xb0, 0x2f, 0x0a, 0x74, 0xb6, 0xb6, 0x40, 0x93, 0x2d, 0x08, 0x00, 0x45, 0x00, 0x00, 0x69, 0x72, 0x5d, 0x00, 0x00, 0x40, 0x11, 0x80, 0xa6, 0xc0, 0xa8, 0x01, 0xfe, 0xc0, 0xa8, 0x04, 0x32, 0x00, 0x35, 0xc8, 0xe1, 0x00, 0x55, 0x4c, 0x59, 0x88, 0xcc, 0x81, 0x80, 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x34, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0xc0, 0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x00, 0x00, 0xc3, 0x00, 0x0c, 0x07, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x01, 0x6c, 0xc0, 0x15, 0x0d, 0x31, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01, 0x2c, 0x00, 0x04, 0xac, 0x00, 0x00, 0xce }; unsigned int invalid_response_size_2 = 119; /* Invalid response packet 3 */ /* where the last 7 Bytes are deleted, which leads to buffer OOB in _nx_dns_resource_data_length_get(), then is detected.*/ char invalid_response_ptr_3[112] = { 0x1c, 0x1a, 0xdf, 0xb0, 0x2f, 0x0a, 0x74, 0xb6, 0xb6, 0x40, 0x93, 0x2d, 0x08, 0x00, 0x45, 0x00, 0x00, 0x69, 0x72, 0x5d, 0x00, 0x00, 0x40, 0x11, 0x80, 0xa6, 0xc0, 0xa8, 0x01, 0xfe, 0xc0, 0xa8, 0x04, 0x32, 0x00, 0x35, 0xc8, 0xe1, 0x00, 0x55, 0x4c, 0x59, 0x88, 0xcc, 0x81, 0x80, 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x34, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0xc0, 0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x00, 0x00, 0xc3, 0x00, 0x0c, 0x07, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x01, 0x6c, 0xc0, 0x15, 0xc0, 0x31, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00 }; unsigned int invalid_response_size_3 = 112;