[PATCH] dnsproxy: Fix for CVE-2025-32366 in ConnMan dnsproxy.c

Hello,

In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length
that depends on an RR RDLENGTH value (i.e., *rdlen=ntohs(rr->rdlen)
and memcpy(response+offset,*end,*rdlen)). Here, rdlen may be larger
than the amount of remaining packet data in the current state of
parsing. As a result, values of stack memory locations may be sent
over the network in a response.

This patch adds a check to ensure that (*end + *rdlen) does not exceed
the valid range. If the condition is violated, the function returns
-EINVAL.

Patch diff snippet:

@@ -997,6 +997,9 @@

  if ((offset + *rdlen) > *response_size)
  return -ENOBUFS;
+
+ if ((*end + *rdlen) > max)
+         return -EINVAL;

  memcpy(response + offset, *end, *rdlen);

Please review this patch and consider applying it to address the
CVE-2025-32366 vulnerability.

Best regards,
Yunje Shin
Signed-off-by: Yunje Shin <[email protected]>

--