1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
|
/***************************************************************************/
/* Copyright (c) 2024 Microsoft Corporation */
/* Copyright (c) 2026 Eclipse ThreadX contributors */
/* */
/* This program and the accompanying materials are made available under */
/* the terms of the MIT License which is available at */
/* https://opensource.org/licenses/MIT. */
/* */
/* SPDX-License-Identifier: MIT */
/***************************************************************************/
/* A valid DNS response packet
00000000: 1c1a dfb0 2f0a 74b6 b640 932d 0800 4500 ..../[email protected].
00000010: 0069 725d 0000 4011 80a6 c0a8 01fe c0a8 .ir]..@.........
00000020: 0432 0035 c8e1 0055 4c59 88cc 8180 0001 .2.5...ULY......
00000030: 0002 0000 0000 0863 6c69 656e 7473 3406 .......clients4.
00000040: 676f 6f67 6c65 0363 6f6d 0000 0100 01c0 google.com......
00000050: 0c00 0500 0100 0000 c300 0c07 636c 6965 ............clie
00000060: 6e74 7301 6cc0 15c0 3100 0100 0100 0001 nts.l...1.......
00000070: 2c00 04ac d903 ce ,......
Domain Name System (response)
Transaction ID: 0x88cc
Flags: 0x8180 Standard query response, No error
Questions: 1
Answer RRs: 2
Authority RRs: 0
Additional RRs: 0
Queries
clients4.google.com: type A, class IN
Name: clients4.google.com
[Name Length: 19]
[Label Count: 3]
Type: A (Host Address) (1)
Class: IN (0x0001)
Answers
clients4.google.com: type CNAME, class IN, cname clients.l.google.com
Name: clients4.google.com
Type: CNAME (Canonical NAME for an alias) (5)
Class: IN (0x0001)
Time to live: 195 (3 minutes, 15 seconds)
Data length: 12
CNAME: clients.l.google.com
clients.l.google.com: type A, class IN, addr 172.217.3.206
Name: clients.l.google.com
Type: A (Host Address) (1)
Class: IN (0x0001)
Time to live: 300 (5 minutes)
Data length: 4
Address: 172.217.3.206
[Unsolicited: True]
*/
/* Invalid response packet 0 */
/* where CNAME lableSize 0xc0 (the 80th Byte) is changed to 0x3e,
which leads to name buffer OOB in _nx_dns_name_size_calculate(), then is detected.*/
char invalid_response_ptr_0[119] = {
0x1c, 0x1a, 0xdf, 0xb0, 0x2f, 0x0a, 0x74, 0xb6, 0xb6, 0x40, 0x93, 0x2d, 0x08, 0x00, 0x45, 0x00,
0x00, 0x69, 0x72, 0x5d, 0x00, 0x00, 0x40, 0x11, 0x80, 0xa6, 0xc0, 0xa8, 0x01, 0xfe, 0xc0, 0xa8,
0x04, 0x32, 0x00, 0x35, 0xc8, 0xe1, 0x00, 0x55, 0x4c, 0x59, 0x88, 0xcc, 0x81, 0x80, 0x00, 0x01,
0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x34, 0x06,
0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x3e,
0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x00, 0x00, 0xc3, 0x00, 0x0c, 0x07, 0x63, 0x6c, 0x69, 0x65,
0x6e, 0x74, 0x73, 0x01, 0x6c, 0xc0, 0x15, 0xc0, 0x31, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01,
0x2c, 0x00, 0x04, 0xac, 0xd9, 0x03, 0xce
};
unsigned int invalid_response_size_0 = 119;
/* Invalid response packet 1 */
/* where question lableSize 0x08 (the 55th byte) is changed to 0x3e,
which leads to name buffer OOB in _nx_dns_name_size_calculate(), then is detected.*/
char invalid_response_ptr_1[119] = {
0x1c, 0x1a, 0xdf, 0xb0, 0x2f, 0x0a, 0x74, 0xb6, 0xb6, 0x40, 0x93, 0x2d, 0x08, 0x00, 0x45, 0x00,
0x00, 0x69, 0x72, 0x5d, 0x00, 0x00, 0x40, 0x11, 0x80, 0xa6, 0xc0, 0xa8, 0x01, 0xfe, 0xc0, 0xa8,
0x04, 0x32, 0x00, 0x35, 0xc8, 0xe1, 0x00, 0x55, 0x4c, 0x59, 0x88, 0xcc, 0x81, 0x80, 0x00, 0x01,
0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x3e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x34, 0x06,
0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0x3e,
0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x00, 0x00, 0xc3, 0x00, 0x0c, 0x07, 0x63, 0x6c, 0x69, 0x65,
0x6e, 0x74, 0x73, 0x01, 0x6c, 0xc0, 0x15, 0xc0, 0x31, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01,
0x2c, 0x00, 0x04, 0xac, 0xd9, 0x03, 0xce
};
unsigned int invalid_response_size_1 = 119;
/* Invalid response packet 2 */
/* where A address lableSize 0xc0 (the 104th Byte) is changed to 0x0d, the 117th Byte is changed to 0,
which leads to buffer OOB in _nx_dns_resource_type_get(), then is detected. */
char invalid_response_ptr_2[119] = {
0x1c, 0x1a, 0xdf, 0xb0, 0x2f, 0x0a, 0x74, 0xb6, 0xb6, 0x40, 0x93, 0x2d, 0x08, 0x00, 0x45, 0x00,
0x00, 0x69, 0x72, 0x5d, 0x00, 0x00, 0x40, 0x11, 0x80, 0xa6, 0xc0, 0xa8, 0x01, 0xfe, 0xc0, 0xa8,
0x04, 0x32, 0x00, 0x35, 0xc8, 0xe1, 0x00, 0x55, 0x4c, 0x59, 0x88, 0xcc, 0x81, 0x80, 0x00, 0x01,
0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x34, 0x06,
0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0xc0,
0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x00, 0x00, 0xc3, 0x00, 0x0c, 0x07, 0x63, 0x6c, 0x69, 0x65,
0x6e, 0x74, 0x73, 0x01, 0x6c, 0xc0, 0x15, 0x0d, 0x31, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x01,
0x2c, 0x00, 0x04, 0xac, 0x00, 0x00, 0xce
};
unsigned int invalid_response_size_2 = 119;
/* Invalid response packet 3 */
/* where the last 7 Bytes are deleted,
which leads to buffer OOB in _nx_dns_resource_data_length_get(), then is detected.*/
char invalid_response_ptr_3[112] = {
0x1c, 0x1a, 0xdf, 0xb0, 0x2f, 0x0a, 0x74, 0xb6, 0xb6, 0x40, 0x93, 0x2d, 0x08, 0x00, 0x45, 0x00,
0x00, 0x69, 0x72, 0x5d, 0x00, 0x00, 0x40, 0x11, 0x80, 0xa6, 0xc0, 0xa8, 0x01, 0xfe, 0xc0, 0xa8,
0x04, 0x32, 0x00, 0x35, 0xc8, 0xe1, 0x00, 0x55, 0x4c, 0x59, 0x88, 0xcc, 0x81, 0x80, 0x00, 0x01,
0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x34, 0x06,
0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01, 0xc0,
0x0c, 0x00, 0x05, 0x00, 0x01, 0x00, 0x00, 0x00, 0xc3, 0x00, 0x0c, 0x07, 0x63, 0x6c, 0x69, 0x65,
0x6e, 0x74, 0x73, 0x01, 0x6c, 0xc0, 0x15, 0xc0, 0x31, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00
};
unsigned int invalid_response_size_3 = 112;
|
