|
 |
b626a2 |
From a1a4730c1f02cd85680cf7608ac81e0db59ee522 Mon Sep 17 00:00:00 2001
|
|
|
685f10 |
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
|
|
685f10 |
Date: Wed, 16 Jan 2019 16:27:33 +0100
|
|
|
b626a2 |
Subject: [PATCH] Fix possible crash when loading corrupted file
|
|
|
685f10 |
|
|
|
685f10 |
Some values passes internal triggers by coincidence. Fix the check and
|
|
|
685f10 |
check also first_node_offset before even passing it further.
|
|
|
685f10 |
---
|
|
|
b626a2 |
lib/dns/rbt.c | 6 ++++--
|
|
|
b626a2 |
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
|
685f10 |
|
|
|
685f10 |
diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
|
|
|
b626a2 |
index ef6441b..404fd6d 100644
|
|
|
685f10 |
--- a/lib/dns/rbt.c
|
|
|
685f10 |
+++ b/lib/dns/rbt.c
|
|
|
b626a2 |
@@ -754,7 +754,7 @@ treefix(dns_rbt_t *rbt, void *base, size_t filesize, dns_rbtnode_t *n,
|
|
|
b626a2 |
}
|
|
|
685f10 |
|
|
|
b626a2 |
CONFIRM((void *)n >= base);
|
|
|
b626a2 |
- CONFIRM((char *)n - (char *)base <= (int)nodemax);
|
|
|
b626a2 |
+ CONFIRM((size_t)((char *)n - (char *)base) <= (int)nodemax);
|
|
|
685f10 |
CONFIRM(DNS_RBTNODE_VALID(n));
|
|
|
685f10 |
|
|
|
685f10 |
dns_name_init(&nodename, NULL);
|
|
|
b626a2 |
@@ -911,7 +911,9 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,
|
|
|
b626a2 |
rbt->root = (dns_rbtnode_t *)((char *)base_address + header_offset +
|
|
|
b626a2 |
header->first_node_offset);
|
|
|
685f10 |
|
|
|
685f10 |
- if ((header->nodecount * sizeof(dns_rbtnode_t)) > filesize) {
|
|
|
685f10 |
+ if ((header->nodecount * sizeof(dns_rbtnode_t)) > filesize
|
|
|
685f10 |
+ || header->first_node_offset > filesize) {
|
|
|
b626a2 |
+
|
|
|
685f10 |
result = ISC_R_INVALIDFILE;
|
|
|
685f10 |
goto cleanup;
|
|
|
685f10 |
}
|
|
|
685f10 |
--
|
|
|
b626a2 |
2.21.1
|
|
|
685f10 |
|