nss_dns: Validate RDATA length against packet length [BZ #19830]
In _nss_dns_getcanonname_r, a check for the availability of RR metadata was missing as well.
This commit is contained in:
parent
b9bdfa7c8f
commit
f749498fa5
|
@ -1,3 +1,11 @@
|
|||
2016-04-27 Florian Weimer <fweimer@redhat.com>
|
||||
|
||||
[BZ #19830]
|
||||
* resolv/nss_dns/dns-host.c (getanswer_r): Check RDATA length.
|
||||
(gaih_getanswer_slice): Likewise.
|
||||
* resolv/nss_dns/dns-canon.c (_nss_dns_getcanonname_r): Likewise.
|
||||
Also check for availability of RR metadata.
|
||||
|
||||
2016-04-27 Florian Weimer <fweimer@redhat.com>
|
||||
|
||||
[BZ #19825]
|
||||
|
|
|
@ -103,6 +103,11 @@ _nss_dns_getcanonname_r (const char *name, char *buffer, size_t buflen,
|
|||
|
||||
ptr += s;
|
||||
|
||||
/* Check that there are enough bytes for the RR
|
||||
metadata. */
|
||||
if (endptr - ptr < 10)
|
||||
goto unavail;
|
||||
|
||||
/* Check whether type and class match. */
|
||||
uint_fast16_t type;
|
||||
NS_GET16 (type, ptr);
|
||||
|
@ -137,11 +142,16 @@ _nss_dns_getcanonname_r (const char *name, char *buffer, size_t buflen,
|
|||
if (__ns_get16 (ptr) != ns_c_in)
|
||||
goto unavail;
|
||||
|
||||
/* Also skip over the TTL. */
|
||||
/* Also skip over class and TTL. */
|
||||
ptr += sizeof (uint16_t) + sizeof (uint32_t);
|
||||
|
||||
/* Skip over the data length and data. */
|
||||
ptr += sizeof (uint16_t) + __ns_get16 (ptr);
|
||||
/* Skip over RDATA length and RDATA itself. */
|
||||
uint16_t rdatalen = __ns_get16 (ptr);
|
||||
ptr += sizeof (uint16_t);
|
||||
/* Not enough room for RDATA. */
|
||||
if (endptr - ptr < rdatalen)
|
||||
goto unavail;
|
||||
ptr += rdatalen;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
@ -751,6 +751,14 @@ getanswer_r (const querybuf *answer, int anslen, const char *qname, int qtype,
|
|||
cp += INT32SZ; /* TTL */
|
||||
n = __ns_get16 (cp);
|
||||
cp += INT16SZ; /* len */
|
||||
|
||||
if (end_of_message - cp < n)
|
||||
{
|
||||
/* RDATA extends beyond the end of the packet. */
|
||||
++had_error;
|
||||
continue;
|
||||
}
|
||||
|
||||
if (__glibc_unlikely (class != C_IN))
|
||||
{
|
||||
/* XXX - debug? syslog? */
|
||||
|
@ -1077,6 +1085,13 @@ gaih_getanswer_slice (const querybuf *answer, int anslen, const char *qname,
|
|||
n = __ns_get16 (cp);
|
||||
cp += INT16SZ; /* len */
|
||||
|
||||
if (end_of_message - cp < n)
|
||||
{
|
||||
/* RDATA extends beyond the end of the packet. */
|
||||
++had_error;
|
||||
continue;
|
||||
}
|
||||
|
||||
if (class != C_IN)
|
||||
{
|
||||
cp += n;
|
||||
|
|
Loading…
Reference in New Issue