Blame SOURCES/dnsmasq-2.76-CVE-2017-14496.patch

a03026
From 5ab67e936085a9e584c9b3e43f442ef5bee7f40e Mon Sep 17 00:00:00 2001
a03026
From: Simon Kelley <simon@thekelleys.org.uk>
a03026
Date: Mon, 25 Sep 2017 20:11:58 +0100
a03026
Subject: [PATCH 5/9]     Security fix, CVE-2017-14496, Integer underflow in
a03026
 DNS response creation.
a03026
a03026
    Fix DoS in DNS. Invalid boundary checks in the
a03026
    add_pseudoheader function allows a memcpy call with negative
a03026
    size An attacker which can send malicious DNS queries
a03026
    to dnsmasq can trigger a DoS remotely.
a03026
    dnsmasq is vulnerable only if one of the following option is
a03026
    specified: --add-mac, --add-cpe-id or --add-subnet.
a03026
---
a03026
 src/edns0.c | 13 ++++++++++++-
a03026
 1 file changed, 12 insertions(+), 1 deletion(-)
a03026
a03026
diff --git a/src/edns0.c b/src/edns0.c
a03026
index d2b514b..eed135e 100644
a03026
--- a/src/edns0.c
a03026
+++ b/src/edns0.c
a03026
@@ -144,7 +144,7 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
a03026
 	  GETSHORT(len, p);
a03026
 	  
a03026
 	  /* malformed option, delete the whole OPT RR and start again. */
a03026
-	  if (i + len > rdlen)
a03026
+	  if (i + 4 + len > rdlen)
a03026
 	    {
a03026
 	      rdlen = 0;
a03026
 	      is_last = 0;
a03026
@@ -193,6 +193,8 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
a03026
 			     ntohs(header->ancount) + ntohs(header->nscount) + ntohs(header->arcount), 
a03026
 			     header, plen)))
a03026
 	return plen;
a03026
+      if (p + 11 > limit)
a03026
+       return plen; /* Too big */
a03026
       *p++ = 0; /* empty name */
a03026
       PUTSHORT(T_OPT, p);
a03026
       PUTSHORT(udp_sz, p); /* max packet length, 512 if not given in EDNS0 header */
a03026
@@ -204,6 +206,11 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
a03026
       /* Copy back any options */
a03026
       if (buff)
a03026
 	{
a03026
+          if (p + rdlen > limit)
a03026
+          {
a03026
+            free(buff);
a03026
+            return plen; /* Too big */
a03026
+          }
a03026
 	  memcpy(p, buff, rdlen);
a03026
 	  free(buff);
a03026
 	  p += rdlen;
a03026
@@ -217,8 +224,12 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
a03026
   /* Add new option */
a03026
   if (optno != 0 && replace != 2)
a03026
     {
a03026
+      if (p + 4 > limit)
a03026
+       return plen; /* Too big */
a03026
       PUTSHORT(optno, p);
a03026
       PUTSHORT(optlen, p);
a03026
+      if (p + optlen > limit)
a03026
+       return plen; /* Too big */
a03026
       memcpy(p, opt, optlen);
a03026
       p += optlen;  
a03026
       PUTSHORT(p - datap, lenp);
a03026
-- 
a03026
2.9.5
a03026