[PATCH 0/4] resolv: Fixing slight buffer misuse in send_dg

[Florian Weimer]

When send_dg calls res_queriesmatch, it does not pass the right buffer
length.  It uses the full buffer size, not the length of the received
packet.  This allows confirmation of the previous (uninitialized) buffer
contents.  I don't think this is a security vulnerability because the
bytes themselves do not leak, so it's a potential very low-bandwith side
channel only.

There is also a bug in res_queriesmatch, which did not handle the
ternary return value from res_nameinquery.

The first issue was found with a somewhat older proprietary LLM, with a
generic security-focused prompt targeted at the resolv subdirectory.
The second issue (the ternary return value) was discovered when the new
test still failed after fixing the first bug.

Thanks,
Florian

Florian Weimer (4):
  support: Add resolv_response_set_buffer
  resolv: Handle ternary return value in __libc_res_queriesmatch (bug
    34345)
  resolv: Fix __libc_res_queriesmatch buffer size argument in send_dg
    (bug 34346)
  resolv: Test case for accepting mismatching, corrupted packets

 resolv/Makefile                      |   3 +
 resolv/res_queriesmatch.c            |   3 +-
 resolv/res_send.c                    |   4 +-
 resolv/tst-resolv-querymatch-short.c | 109 +++++++++++++++++++++++++++
 support/resolv_test.c                |  17 ++++-
 support/resolv_test.h                |  15 ++++
 6 files changed, 144 insertions(+), 7 deletions(-)
 create mode 100644 resolv/tst-resolv-querymatch-short.c


base-commit: 84c3993f1ff1546c8dd06c3ced5d2bed0be649c0
-- 
2.54.0