lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-08-01 10:06:57 +03:00
Code Activity

nss_dns: Validate RDATA length against packet length [BZ #19830]

Browse Source 
In _nss_dns_getcanonname_r, a check for the availability of RR metadata
was missing as well.
This commit is contained in:
Florian Weimer
2016-04-27 15:11:41 +02:00
parent b9bdfa7c8f
commit f749498fa5
3 changed files with 36 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog
View File

@ -1,3 +1,11 @@
2016-04-27 Florian Weimer <fweimer@redhat.com>
[BZ #19830]
* resolv/nss_dns/dns-host.c (getanswer_r): Check RDATA length.
(gaih_getanswer_slice): Likewise.
* resolv/nss_dns/dns-canon.c (_nss_dns_getcanonname_r): Likewise.
Also check for availability of RR metadata.
2016-04-27 Florian Weimer <fweimer@redhat.com> 2016-04-27 Florian Weimer <fweimer@redhat.com>
[BZ #19825] [BZ #19825]

16
resolv/nss_dns/dns-canon.c
View File

@ -103,6 +103,11 @@ _nss_dns_getcanonname_r (const char *name, char *buffer, size_t buflen,
ptr += s; ptr += s;
/* Check that there are enough bytes for the RR
metadata. */
if (endptr - ptr < 10)
goto unavail;
/* Check whether type and class match. */ /* Check whether type and class match. */
uint_fast16_t type; uint_fast16_t type;
NS_GET16 (type, ptr); NS_GET16 (type, ptr);
@ -137,11 +142,16 @@ _nss_dns_getcanonname_r (const char *name, char *buffer, size_t buflen,
if (__ns_get16 (ptr) != ns_c_in) if (__ns_get16 (ptr) != ns_c_in)
goto unavail; goto unavail;
/* Also skip over the TTL. */ /* Also skip over class and TTL. */
ptr += sizeof (uint16_t) + sizeof (uint32_t); ptr += sizeof (uint16_t) + sizeof (uint32_t);
/* Skip over the data length and data. */ /* Skip over RDATA length and RDATA itself. */
ptr += sizeof (uint16_t) + __ns_get16 (ptr); uint16_t rdatalen = __ns_get16 (ptr);
ptr += sizeof (uint16_t);
/* Not enough room for RDATA. */
if (endptr - ptr < rdatalen)
goto unavail;
ptr += rdatalen;
} }
} }

15
resolv/nss_dns/dns-host.c
View File

@ -751,6 +751,14 @@ getanswer_r (const querybuf *answer, int anslen, const char *qname, int qtype,
cp += INT32SZ; /* TTL */ cp += INT32SZ; /* TTL */
n = __ns_get16 (cp); n = __ns_get16 (cp);
cp += INT16SZ; /* len */ cp += INT16SZ; /* len */
if (end_of_message - cp < n)
{
/* RDATA extends beyond the end of the packet. */
++had_error;
continue;
}
if (__glibc_unlikely (class != C_IN)) if (__glibc_unlikely (class != C_IN))
{ {
/* XXX - debug? syslog? */ /* XXX - debug? syslog? */
@ -1077,6 +1085,13 @@ gaih_getanswer_slice (const querybuf *answer, int anslen, const char *qname,
n = __ns_get16 (cp); n = __ns_get16 (cp);
cp += INT16SZ; /* len */ cp += INT16SZ; /* len */
if (end_of_message - cp < n)
{
/* RDATA extends beyond the end of the packet. */
++had_error;
continue;
}
if (class != C_IN) if (class != C_IN)
{ {
cp += n; cp += n;