Skip to content

Commit c45738b

Browse files
google-labs-jules[bot]lws-team
authored andcommitted
Fix use-after-free on duplicate async DNS response
When a duplicate async DNS response packet is received, the code would jump to the `fail_out` label, which destroys the query object `q`. This is incorrect if the query is still waiting for other responses (eg, AAAA after getting a duplicate A response). The destruction of `q` leads to a use-after-free when the next response for the same query arrives, causing memory corruption and sporadic crashes. The fix is to simply return when a duplicate packet is detected, ignoring it, without destroying the query object.
1 parent 56a1d4b commit c45738b

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

lib/system/async-dns/async-dns-parse.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -575,7 +575,7 @@ lws_adns_parse_udp(lws_async_dns_t *dns, const uint8_t *pkt, size_t len)
575575
n = 1 << (lws_ser_ru16be(pkt + DHO_TID) & 1);
576576
if (q->responded & n) {
577577
lwsl_notice("%s: dup\n", __func__);
578-
goto fail_out;
578+
return;
579579
}
580580

581581
q->responded = (uint8_t)(q->responded | n);

0 commit comments

Comments
 (0)