|
 |
230545 |
From c5a9fd85a19a63f88a5f17c7e6d074ee22364093 Mon Sep 17 00:00:00 2001
|
|
|
230545 |
From: Petr Mensik <pemensik@redhat.com>
|
|
|
230545 |
Date: Tue, 18 Aug 2020 10:53:33 +0200
|
|
|
230545 |
Subject: [PATCH] Fix CVE-2020-8622
|
|
|
230545 |
|
|
|
230545 |
5476. [security] It was possible to trigger an assertion failure when
|
|
|
230545 |
verifying the response to a TSIG-signed request.
|
|
|
230545 |
(CVE-2020-8622) [GL #2028]
|
|
|
230545 |
---
|
|
|
230545 |
lib/dns/message.c | 24 +++++++++++++-----------
|
|
|
230545 |
1 file changed, 13 insertions(+), 11 deletions(-)
|
|
|
230545 |
|
|
|
230545 |
diff --git a/lib/dns/message.c b/lib/dns/message.c
|
|
|
230545 |
index d9e341a..7c813a5 100644
|
|
|
230545 |
--- a/lib/dns/message.c
|
|
|
230545 |
+++ b/lib/dns/message.c
|
|
|
230545 |
@@ -1712,6 +1712,19 @@ dns_message_parse(dns_message_t *msg, isc_buffer_t *source,
|
|
|
230545 |
msg->header_ok = 0;
|
|
|
230545 |
msg->question_ok = 0;
|
|
|
230545 |
|
|
|
230545 |
+ if ((options & DNS_MESSAGEPARSE_CLONEBUFFER) == 0) {
|
|
|
230545 |
+ isc_buffer_usedregion(&origsource, &msg->saved);
|
|
|
230545 |
+ } else {
|
|
|
230545 |
+ msg->saved.length = isc_buffer_usedlength(&origsource);
|
|
|
230545 |
+ msg->saved.base = isc_mem_get(msg->mctx, msg->saved.length);
|
|
|
230545 |
+ if (msg->saved.base == NULL) {
|
|
|
230545 |
+ return (ISC_R_NOMEMORY);
|
|
|
230545 |
+ }
|
|
|
230545 |
+ memmove(msg->saved.base, isc_buffer_base(&origsource),
|
|
|
230545 |
+ msg->saved.length);
|
|
|
230545 |
+ msg->free_saved = 1;
|
|
|
230545 |
+ }
|
|
|
230545 |
+
|
|
|
230545 |
isc_buffer_remainingregion(source, &r);
|
|
|
230545 |
if (r.length < DNS_MESSAGE_HEADERLEN)
|
|
|
230545 |
return (ISC_R_UNEXPECTEDEND);
|
|
|
230545 |
@@ -1787,17 +1800,6 @@ dns_message_parse(dns_message_t *msg, isc_buffer_t *source,
|
|
|
230545 |
}
|
|
|
230545 |
|
|
|
230545 |
truncated:
|
|
|
230545 |
- if ((options & DNS_MESSAGEPARSE_CLONEBUFFER) == 0)
|
|
|
230545 |
- isc_buffer_usedregion(&origsource, &msg->saved);
|
|
|
230545 |
- else {
|
|
|
230545 |
- msg->saved.length = isc_buffer_usedlength(&origsource);
|
|
|
230545 |
- msg->saved.base = isc_mem_get(msg->mctx, msg->saved.length);
|
|
|
230545 |
- if (msg->saved.base == NULL)
|
|
|
230545 |
- return (ISC_R_NOMEMORY);
|
|
|
230545 |
- memmove(msg->saved.base, isc_buffer_base(&origsource),
|
|
|
230545 |
- msg->saved.length);
|
|
|
230545 |
- msg->free_saved = 1;
|
|
|
230545 |
- }
|
|
|
230545 |
|
|
|
230545 |
if (ret == ISC_R_UNEXPECTEDEND && ignore_tc)
|
|
|
230545 |
return (DNS_R_RECOVERABLE);
|
|
|
230545 |
--
|
|
|
230545 |
2.26.2
|
|
|
230545 |
|