forked from pool/glibc
78 lines
2.3 KiB
Diff
78 lines
2.3 KiB
Diff
|
2016-04-27 Florian Weimer <fweimer@redhat.com>
|
||
|
|
|
||
|
|
[BZ #19830]
|
||
|
|
* resolv/nss_dns/dns-host.c (getanswer_r): Check RDATA length.
|
||
|
|
(gaih_getanswer_slice): Likewise.
|
||
|
|
* resolv/nss_dns/dns-canon.c (_nss_dns_getcanonname_r): Likewise.
|
||
|
|
Also check for availability of RR metadata.
|
||
|
|
|
||
|
|
Index: glibc-2.23/resolv/nss_dns/dns-canon.c
|
||
|
|
===================================================================
|
||
|
|
--- glibc-2.23.orig/resolv/nss_dns/dns-canon.c
|
||
|
|
+++ glibc-2.23/resolv/nss_dns/dns-canon.c
|
||
|
|
@@ -103,6 +103,11 @@ _nss_dns_getcanonname_r (const char *nam
|
||
|
|
|
||
|
|
ptr += s;
|
||
|
|
|
||
|
|
+ /* Check that there are enough bytes for the RR
|
||
|
|
+ metadata. */
|
||
|
|
+ if (endptr - ptr < 10)
|
||
|
|
+ goto unavail;
|
||
|
|
+
|
||
|
|
/* Check whether type and class match. */
|
||
|
|
uint_fast16_t type;
|
||
|
|
NS_GET16 (type, ptr);
|
||
|
|
@@ -137,11 +142,16 @@ _nss_dns_getcanonname_r (const char *nam
|
||
|
|
if (__ns_get16 (ptr) != ns_c_in)
|
||
|
|
goto unavail;
|
||
|
|
|
||
|
|
- /* Also skip over the TTL. */
|
||
|
|
+ /* Also skip over class and TTL. */
|
||
|
|
ptr += sizeof (uint16_t) + sizeof (uint32_t);
|
||
|
|
|
||
|
|
- /* Skip over the data length and data. */
|
||
|
|
- ptr += sizeof (uint16_t) + __ns_get16 (ptr);
|
||
|
|
+ /* Skip over RDATA length and RDATA itself. */
|
||
|
|
+ uint16_t rdatalen = __ns_get16 (ptr);
|
||
|
|
+ ptr += sizeof (uint16_t);
|
||
|
|
+ /* Not enough room for RDATA. */
|
||
|
|
+ if (endptr - ptr < rdatalen)
|
||
|
|
+ goto unavail;
|
||
|
|
+ ptr += rdatalen;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
Index: glibc-2.23/resolv/nss_dns/dns-host.c
|
||
|
|
===================================================================
|
||
|
|
--- glibc-2.23.orig/resolv/nss_dns/dns-host.c
|
||
|
|
+++ glibc-2.23/resolv/nss_dns/dns-host.c
|
||
|
|
@@ -751,6 +751,14 @@ getanswer_r (const querybuf *answer, int
|
||
|
|
cp += INT32SZ; /* TTL */
|
||
|
|
n = __ns_get16 (cp);
|
||
|
|
cp += INT16SZ; /* len */
|
||
|
|
+
|
||
|
|
+ if (end_of_message - cp < n)
|
||
|
|
+ {
|
||
|
|
+ /* RDATA extends beyond the end of the packet. */
|
||
|
|
+ ++had_error;
|
||
|
|
+ continue;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
if (__glibc_unlikely (class != C_IN))
|
||
|
|
{
|
||
|
|
/* XXX - debug? syslog? */
|
||
|
|
@@ -1077,6 +1085,13 @@ gaih_getanswer_slice (const querybuf *an
|
||
|
|
n = __ns_get16 (cp);
|
||
|
|
cp += INT16SZ; /* len */
|
||
|
|
|
||
|
|
+ if (end_of_message - cp < n)
|
||
|
|
+ {
|
||
|
|
+ /* RDATA extends beyond the end of the packet. */
|
||
|
|
+ ++had_error;
|
||
|
|
+ continue;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
if (class != C_IN)
|
||
|
|
{
|
||
|
|
cp += n;
|