Copy the entire zero-separated DNS seach domain string.
The DNS search string contains zeros as domain separator. The resolver
code erroneously used strlcpy(), which resulted in only the first domain
to be copied. The code uses pointers into this string to access the
individual domains. Since the structure is zero-initialized, this bug only
resulted in zero-length domains instead of accessing unitialized memory.
BUG: 27312811
Change-Id: Ia9d066c405dfcc5e82d6766d93ead2ce574e7b0d
diff --git a/libc/dns/resolv/res_cache.c b/libc/dns/resolv/res_cache.c
index 5a78450..ae8debb 100644
--- a/libc/dns/resolv/res_cache.c
+++ b/libc/dns/resolv/res_cache.c
@@ -2093,7 +2093,8 @@
statp->nscount = nserv;
// now do search domains. Note that we cache the offsets as this code runs alot
// but the setting/offset-computer only runs when set/changed
- strlcpy(statp->defdname, info->defdname, sizeof(statp->defdname));
+ // WARNING: Don't use str*cpy() here, this string contains zeroes.
+ memcpy(statp->defdname, info->defdname, sizeof(statp->defdname));
register char **pp = statp->dnsrch;
register int *p = info->dnsrch_offset;
while (pp < statp->dnsrch + MAXDNSRCH && *p != -1) {