mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-07-08 18:11:52 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

LibDNS+RequestServer: Fix UAF in lookup() by changing Span -> Vector

Browse source 
Co-authored-by: Ali Mohammad Pur <ali.mpfard@gmail.com>
This commit is contained in:
rmg-x 2025-02-10 18:11:19 -06:00 • committed by Ali Mohammad Pur
parent 4904326244
commit ec481aa08a
Notes: github-actions[bot] 2025-02-11 06:25:28 +00:00
2 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Libraries/LibDNS/Resolver.h
View file

@ -213,10 +213,10 @@ public:
NonnullRefPtr<Core::Promise<NonnullRefPtr<LookupResult const>>> lookup(ByteString name, Messages::Class class_ = Messages::Class::IN)
{
return lookup(move(name), class_, Array { Messages::ResourceType::A, Messages::ResourceType::AAAA });
return lookup(move(name), class_, { Messages::ResourceType::A, Messages::ResourceType::AAAA });
}
NonnullRefPtr<Core::Promise<NonnullRefPtr<LookupResult const>>> lookup(ByteString name, Messages::Class class_, Span<Messages::ResourceType const> desired_types, PendingLookup* repeating_lookup = nullptr)
NonnullRefPtr<Core::Promise<NonnullRefPtr<LookupResult const>>> lookup(ByteString name, Messages::Class class_, Vector<Messages::ResourceType> desired_types, PendingLookup* repeating_lookup = nullptr)
{
flush_cache();

4
Services/RequestServer/ConnectionFromClient.cpp
View file

@ -344,7 +344,7 @@ void ConnectionFromClient::start_request(i32 request_id, ByteString const& metho
}
auto host = url.serialized_host().to_byte_string();
m_resolver->dns.lookup(host, DNS::Messages::Class::IN, Array { DNS::Messages::ResourceType::A, DNS::Messages::ResourceType::AAAA }.span())
m_resolver->dns.lookup(host, DNS::Messages::Class::IN, { DNS::Messages::ResourceType::A, DNS::Messages::ResourceType::AAAA })
->when_rejected([this, request_id](auto const& error) {
dbgln("StartRequest: DNS lookup failed: {}", error);
async_request_finished(request_id, 0, Requests::NetworkError::UnableToResolveHost);
@ -604,7 +604,7 @@ void ConnectionFromClient::ensure_connection(URL::URL const& url, ::RequestServe
}
if (cache_level == CacheLevel::ResolveOnly) {
[[maybe_unused]] auto promise = m_resolver->dns.lookup(url.serialized_host().to_byte_string(), DNS::Messages::Class::IN, Array { DNS::Messages::ResourceType::A, DNS::Messages::ResourceType::AAAA }.span());
[[maybe_unused]] auto promise = m_resolver->dns.lookup(url.serialized_host().to_byte_string(), DNS::Messages::Class::IN, { DNS::Messages::ResourceType::A, DNS::Messages::ResourceType::AAAA });
if constexpr (REQUESTSERVER_DEBUG) {
Core::ElapsedTimer timer;
timer.start();