lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-07-29 11:41:21 +03:00
Code Activity

nss_dns: Validate RDATA length against packet length [BZ #19830]

Browse Source 
In _nss_dns_getcanonname_r, a check for the availability of RR metadata
was missing as well.
This commit is contained in:
Florian Weimer
2016-04-27 15:11:41 +02:00
parent b9bdfa7c8f
commit f749498fa5
3 changed files with 36 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
resolv/nss_dns/dns-canon.c
View File

@ -103,6 +103,11 @@ _nss_dns_getcanonname_r (const char *name, char *buffer, size_t buflen,
ptr += s;
/* Check that there are enough bytes for the RR
metadata. */
if (endptr - ptr < 10)
goto unavail;
/* Check whether type and class match. */
uint_fast16_t type;
NS_GET16 (type, ptr);
@ -137,11 +142,16 @@ _nss_dns_getcanonname_r (const char *name, char *buffer, size_t buflen,
if (__ns_get16 (ptr) != ns_c_in)
goto unavail;
/* Also skip over the TTL. */
/* Also skip over class and TTL. */
ptr += sizeof (uint16_t) + sizeof (uint32_t);
/* Skip over the data length and data. */
ptr += sizeof (uint16_t) + __ns_get16 (ptr);
/* Skip over RDATA length and RDATA itself. */
uint16_t rdatalen = __ns_get16 (ptr);
ptr += sizeof (uint16_t);
/* Not enough room for RDATA. */
if (endptr - ptr < rdatalen)
goto unavail;
ptr += rdatalen;
}
}

15
resolv/nss_dns/dns-host.c
View File

@ -751,6 +751,14 @@ getanswer_r (const querybuf *answer, int anslen, const char *qname, int qtype,
cp += INT32SZ; /* TTL */
n = __ns_get16 (cp);
cp += INT16SZ; /* len */
if (end_of_message - cp < n)
{
/* RDATA extends beyond the end of the packet. */
++had_error;
continue;
}
if (__glibc_unlikely (class != C_IN))
{
/* XXX - debug? syslog? */
@ -1077,6 +1085,13 @@ gaih_getanswer_slice (const querybuf *answer, int anslen, const char *qname,
n = __ns_get16 (cp);
cp += INT16SZ; /* len */
if (end_of_message - cp < n)
{
/* RDATA extends beyond the end of the packet. */
++had_error;
continue;
}
if (class != C_IN)
{
cp += n;