[glibc] resolv: Fix __libc_res_queriesmatch buffer size argument in send_dg (bug 34346)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ab4b07d2ac1ed7d7b1b2f02fd0a24b8c0bbd4a59

commit ab4b07d2ac1ed7d7b1b2f02fd0a24b8c0bbd4a59
Author: Florian Weimer <[email protected]>
Date:   Sat Aug 15 12:03:35 2026 +0200

    resolv: Fix __libc_res_queriesmatch buffer size argument in send_dg (bug 34346)
    
    Pass the number of bytes written by recvfrom, not the entire size
    of the buffer.
    
    This is not a security vulnerability because it only allows
    confirmation of previously existing buffer values.  All reads stay
    within the specified buffer bounds.  The buffer contents may not have
    been initialized.  Subsequent processing is correctly capped at buffer
    bounds, too.
    
    Reviewed-by: Adhemerval Zanella <[email protected]>

Diff:
---
 resolv/res_send.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/resolv/res_send.c b/resolv/res_send.c
index cf27fa7ad6..cc65a03e7d 100644
--- a/resolv/res_send.c
+++ b/resolv/res_send.c
@@ -1215,14 +1215,14 @@ send_dg(res_state statp,
 		    && (skip_query_match
 			|| __libc_res_queriesmatch (buf, buf + buflen,
 						    *thisansp,
-						    *thisansp + *thisanssizp)))
+						    *thisansp + *thisresplenp)))
 		  matching_query = 1;
 		if (!recvresp2
 		    && anhp->id == hp2->id
 		    && (skip_query_match
 			|| __libc_res_queriesmatch (buf2, buf2 + buflen2,
 						    *thisansp,
-						    *thisansp + *thisanssizp)))
+						    *thisansp + *thisresplenp)))
 		  matching_query = 2;
 		if (matching_query == 0)
 		  /* Spurious UDP packet.  Drop it and continue