From 6b9716ca5aa1bfe44c0d1ad7030446b28b4f9f84 Mon Sep 17 00:00:00 2001

From: Stepan Broz <sbroz@redhat.com>

Date: Mon, 25 Sep 2023 12:41:54 +0200

Subject: [PATCH 1/1] Backport of CVE-2023-3341 fix

Taken from BIND 9.16.44 change.

---

 lib/isccc/cc.c                   | 36 +++++++++++++++++++++++---------

 lib/isccc/include/isccc/result.h |  4 +++-

 lib/isccc/result.c               |  4 +++-

 3 files changed, 32 insertions(+), 12 deletions(-)

diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c

index 42b3046..7f67d70 100644

--- a/lib/isccc/cc.c

+++ b/lib/isccc/cc.c

@@ -51,6 +51,10 @@

 #define MAX_TAGS		256

 #define DUP_LIFETIME		900

+#ifndef ISCCC_MAXDEPTH

+#define ISCCC_MAXDEPTH \

+	10 /* Big enough for rndc which just sends a string each way. */

+#endif

 typedef isccc_sexpr_t *sexpr_ptr;

@@ -571,19 +575,23 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,

 static isc_result_t

 table_fromwire(isccc_region_t *source, isccc_region_t *secret,

-	       isc_uint32_t algorithm, isccc_sexpr_t **alistp);

+	       isc_uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp);

 static isc_result_t

-list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp);

+list_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **listp);

 static isc_result_t

-value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {

+value_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **valuep) {

 	unsigned int msgtype;

 	isc_uint32_t len;

 	isccc_sexpr_t *value;

 	isccc_region_t active;

 	isc_result_t result;

+	if (depth > ISCCC_MAXDEPTH) {

+		return (ISCCC_R_MAXDEPTH);

+	}

+

 	if (REGION_SIZE(*source) < 1 + 4)

 		return (ISC_R_UNEXPECTEDEND);

 	GET8(msgtype, source->rstart);

@@ -601,9 +609,9 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {

 		} else

 			result = ISC_R_NOMEMORY;

 	} else if (msgtype == ISCCC_CCMSGTYPE_TABLE)

-		result = table_fromwire(&active, NULL, 0, valuep);

+		result = table_fromwire(&active, NULL, 0, depth + 1, valuep);

 	else if (msgtype == ISCCC_CCMSGTYPE_LIST)

-		result = list_fromwire(&active, valuep);

+		result = list_fromwire(&active, depth + 1, valuep);

 	else

 		result = ISCCC_R_SYNTAX;

@@ -612,7 +620,7 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {

 static isc_result_t

 table_fromwire(isccc_region_t *source, isccc_region_t *secret,

-	       isc_uint32_t algorithm, isccc_sexpr_t **alistp)

+	       isc_uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp)

 {

 	char key[256];

 	isc_uint32_t len;

@@ -623,6 +631,10 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,

 	REQUIRE(alistp != NULL && *alistp == NULL);

+	if (depth > ISCCC_MAXDEPTH) {

+		return (ISCCC_R_MAXDEPTH);

+	}

+

 	checksum_rstart = NULL;

 	first_tag = ISC_TRUE;

 	alist = isccc_alist_create();

@@ -638,7 +650,7 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,

 		GET_MEM(key, len, source->rstart);

 		key[len] = '\0';	/* Ensure NUL termination. */

 		value = NULL;

-		result = value_fromwire(source, &value);

+		result = value_fromwire(source, depth + 1, &value);

 		if (result != ISC_R_SUCCESS)

 			goto bad;

 		if (isccc_alist_define(alist, key, value) == NULL) {

@@ -671,14 +683,18 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,

 }

 static isc_result_t

-list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp) {

+list_fromwire(isccc_region_t *source, unsigned int depth, isccc_sexpr_t **listp) {

 	isccc_sexpr_t *list, *value;

 	isc_result_t result;

+	if (depth > ISCCC_MAXDEPTH) {

+		return (ISCCC_R_MAXDEPTH);

+	}

+

 	list = NULL;

 	while (!REGION_EMPTY(*source)) {

 		value = NULL;

-		result = value_fromwire(source, &value);

+		result = value_fromwire(source, depth + 1, &value);

 		if (result != ISC_R_SUCCESS) {

 			isccc_sexpr_free(&list);

 			return (result);

@@ -709,7 +725,7 @@ isccc_cc_fromwire(isccc_region_t *source, isccc_sexpr_t **alistp,

 	if (version != 1)

 		return (ISCCC_R_UNKNOWNVERSION);

-	return (table_fromwire(source, secret, algorithm, alistp));

+	return (table_fromwire(source, secret, algorithm, 0, alistp));

 }

 static isc_result_t

diff --git a/lib/isccc/include/isccc/result.h b/lib/isccc/include/isccc/result.h

index 6ff81ad..3e14ee0 100644

--- a/lib/isccc/include/isccc/result.h

+++ b/lib/isccc/include/isccc/result.h

@@ -47,8 +47,10 @@

 #define ISCCC_R_CLOCKSKEW		(ISC_RESULTCLASS_ISCCC + 4)

 /*% Duplicate */

 #define ISCCC_R_DUPLICATE		(ISC_RESULTCLASS_ISCCC + 5)

+/*% Maximum recursion depth */

+#define ISCCC_R_MAXDEPTH               (ISC_RESULTCLASS_ISCCC + 6)

-#define ISCCC_R_NRESULTS 		6	/*%< Number of results */

+#define ISCCC_R_NRESULTS 		7	/*%< Number of results */

 ISC_LANG_BEGINDECLS

diff --git a/lib/isccc/result.c b/lib/isccc/result.c

index 75f5ade..91df50a 100644

--- a/lib/isccc/result.c

+++ b/lib/isccc/result.c

@@ -40,7 +40,8 @@ static const char *text[ISCCC_R_NRESULTS] = {

 	"bad auth",				/* 3 */

 	"expired",				/* 4 */

 	"clock skew",				/* 5 */

-	"duplicate"				/* 6 */

+	"duplicate",				/* 6 */

+	"max depth",				/* 7 */

 };

 static const char *ids[ISCCC_R_NRESULTS] = {

@@ -50,6 +51,7 @@ static const char *ids[ISCCC_R_NRESULTS] = {

 	"ISCCC_R_EXPIRED",

 	"ISCCC_R_CLOCKSKEW",

 	"ISCCC_R_DUPLICATE",

+	"ISCCC_R_MAXDEPTH",

 };

 #define ISCCC_RESULT_RESULTSET			2

-- 

2.41.0