8813f74f52998224ac52e5fa98e4dbb8dc6247f4 - android_packages_modules_Connectivity

commit	8813f74f52998224ac52e5fa98e4dbb8dc6247f4	[log] [tgz]
author	Paul Hu <paulhu@google.com>	Wed Nov 01 16:32:45 2023 +0800
committer	Paul Hu <paulhu@google.com>	Wed Nov 01 17:38:14 2023 +0800
tree	94f4fc91cb4962df1fb74bc3f25b3ec3ad4acf77
parent	44e46348f434f156f068979f4ac7c819df22501a [diff]

Limit the label count when parsing a mDns packet

If some bytes in the mDNS packet are incorrect, such as the
service name, the MdnsPacketReader will enter an infinite loop
and crash with an out-of-memory error when parsing the data. This
issue can be resolved by limiting the label count when parsing
the mDNS packet. If the label count exceeds the limit, the packet
should be discarded as it is likely corrupted.

Bug: 307475137
Test: Manually test with problematic mnds packet raw data
      atest FrameworksNetTests android.net.cts.NsdManagerTest
Ignore-AOSP-First: Security fix.
Change-Id: I48b1dc26f41549ec4afc71f87e98a02ac773430f

service-t/src/com/android/server/NsdService.java[diff]
service-t/src/com/android/server/connectivity/mdns/MdnsFeatureFlags.java[diff]
service-t/src/com/android/server/connectivity/mdns/MdnsInterfaceAdvertiser.java[diff]
service-t/src/com/android/server/connectivity/mdns/MdnsMultinetworkSocketClient.java[diff]
service-t/src/com/android/server/connectivity/mdns/MdnsPacketReader.java[diff]
service-t/src/com/android/server/connectivity/mdns/MdnsResponseDecoder.java[diff]
service-t/src/com/android/server/connectivity/mdns/MdnsSocketClient.java[diff]
tests/unit/java/com/android/server/connectivity/mdns/MdnsMultinetworkSocketClientTest.java[diff]
tests/unit/java/com/android/server/connectivity/mdns/MdnsPacketReaderTests.java[diff]
tests/unit/java/com/android/server/connectivity/mdns/MdnsPacketTest.kt[diff]
tests/unit/java/com/android/server/connectivity/mdns/MdnsResponseDecoderTests.java[diff]
tests/unit/java/com/android/server/connectivity/mdns/MdnsSocketClientTests.java[diff]

12 files changed

tree: 94f4fc91cb4962df1fb74bc3f25b3ec3ad4acf77