|
 |
e20e41 |
From 62cb936cb7ad5f219715515ae7d32dd281a5aa1f Mon Sep 17 00:00:00 2001
|
|
|
e20e41 |
From: Simon Kelley <simon@thekelleys.org.uk>
|
|
|
e20e41 |
Date: Tue, 26 Sep 2017 22:00:11 +0100
|
|
|
e20e41 |
Subject: Security fix, CVE-2017-14491, DNS heap buffer overflow.
|
|
|
e20e41 |
|
|
|
e20e41 |
Further fix to 0549c73b7ea6b22a3c49beb4d432f185a81efcbc
|
|
|
e20e41 |
Handles case when RR name is not a pointer to the question,
|
|
|
e20e41 |
only occurs for some auth-mode replies, therefore not
|
|
|
e20e41 |
detected by fuzzing (?)
|
|
|
e20e41 |
---
|
|
|
e20e41 |
src/rfc1035.c | 27 +++++++++++++++------------
|
|
|
e20e41 |
1 file changed, 15 insertions(+), 12 deletions(-)
|
|
|
e20e41 |
|
|
|
e20e41 |
diff --git a/src/rfc1035.c b/src/rfc1035.c
|
|
|
e20e41 |
index 27af023..56ab88b 100644
|
|
|
e20e41 |
--- a/src/rfc1035.c
|
|
|
e20e41 |
+++ b/src/rfc1035.c
|
|
|
e20e41 |
@@ -1086,32 +1086,35 @@ int add_resource_record(struct dns_header *header, char *limit, int *truncp, int
|
|
|
e20e41 |
|
|
|
e20e41 |
va_start(ap, format); /* make ap point to 1st unamed argument */
|
|
|
e20e41 |
|
|
|
e20e41 |
- /* nameoffset (1 or 2) + type (2) + class (2) + ttl (4) + 0 (2) */
|
|
|
e20e41 |
- CHECK_LIMIT(12);
|
|
|
e20e41 |
-
|
|
|
e20e41 |
if (nameoffset > 0)
|
|
|
e20e41 |
{
|
|
|
e20e41 |
+ CHECK_LIMIT(2);
|
|
|
e20e41 |
PUTSHORT(nameoffset | 0xc000, p);
|
|
|
e20e41 |
}
|
|
|
e20e41 |
else
|
|
|
e20e41 |
{
|
|
|
e20e41 |
char *name = va_arg(ap, char *);
|
|
|
e20e41 |
- if (name)
|
|
|
e20e41 |
- p = do_rfc1035_name(p, name, limit);
|
|
|
e20e41 |
- if (!p)
|
|
|
e20e41 |
- {
|
|
|
e20e41 |
- va_end(ap);
|
|
|
e20e41 |
- goto truncated;
|
|
|
e20e41 |
- }
|
|
|
e20e41 |
-
|
|
|
e20e41 |
+ if (name && !(p = do_rfc1035_name(p, name, limit)))
|
|
|
e20e41 |
+ {
|
|
|
e20e41 |
+ va_end(ap);
|
|
|
e20e41 |
+ goto truncated;
|
|
|
e20e41 |
+ }
|
|
|
e20e41 |
+
|
|
|
e20e41 |
if (nameoffset < 0)
|
|
|
e20e41 |
{
|
|
|
e20e41 |
+ CHECK_LIMIT(2);
|
|
|
e20e41 |
PUTSHORT(-nameoffset | 0xc000, p);
|
|
|
e20e41 |
}
|
|
|
e20e41 |
else
|
|
|
e20e41 |
- *p++ = 0;
|
|
|
e20e41 |
+ {
|
|
|
e20e41 |
+ CHECK_LIMIT(1);
|
|
|
e20e41 |
+ *p++ = 0;
|
|
|
e20e41 |
+ }
|
|
|
e20e41 |
}
|
|
|
e20e41 |
|
|
|
e20e41 |
+ /* type (2) + class (2) + ttl (4) + rdlen (2) */
|
|
|
e20e41 |
+ CHECK_LIMIT(10);
|
|
|
e20e41 |
+
|
|
|
e20e41 |
PUTSHORT(type, p);
|
|
|
e20e41 |
PUTSHORT(class, p);
|
|
|
e20e41 |
PUTLONG(ttl, p); /* TTL */
|
|
|
e20e41 |
--
|
|
|
e20e41 |
2.7.4
|
|
|
e20e41 |
|