[PATCH 2/2] net: dns: fix OOB read in dns_recv query type check

[Sascha Hauer]

After skipping the query name in a DNS response, dns_recv() reads
p[1] and p[2] to check the query type BEFORE validating that these
offsets are within the packet bounds. The bounds check '&p[5] > e'
follows the reads, but by then the OOB access has already occurred.

If the query name's null terminator is at or near the end of the
packet, p[1] and p[2] read 1-2 bytes past the packet data.

Fix by moving the bounds check before the reads.

Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply at anthropic.com>
---
 net/dns.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/dns.c b/net/dns.c
index fde1439469..5a3ee30720 100644
--- a/net/dns.c
+++ b/net/dns.c
@@ -166,8 +166,13 @@ static void dns_recv(struct header *header, unsigned len)
 		continue;
 
 	/* We sent query class 1, query type 1 */
+	if (&p[5] > e) {
+		pr_debug("DNS response too short\n");
+		return;
+	}
+
 	tmp = p[1] | (p[2] << 8);
-	if (&p[5] > e || ntohs(tmp) != DNS_A_RECORD) {
+	if (ntohs(tmp) != DNS_A_RECORD) {
 		pr_debug("DNS response was not A record\n");
 		return;
 	}

-- 
2.47.3