diff options
| -rw-r--r-- | ChangeLog | 8 | ||||
| -rw-r--r-- | resolv/nss_dns/dns-canon.c | 16 | ||||
| -rw-r--r-- | resolv/nss_dns/dns-host.c | 15 |
3 files changed, 36 insertions, 3 deletions
@@ -1,5 +1,13 @@ 2016-04-27 Florian Weimer <fweimer@redhat.com> + [BZ #19830] + * resolv/nss_dns/dns-host.c (getanswer_r): Check RDATA length. + (gaih_getanswer_slice): Likewise. + * resolv/nss_dns/dns-canon.c (_nss_dns_getcanonname_r): Likewise. + Also check for availability of RR metadata. + +2016-04-27 Florian Weimer <fweimer@redhat.com> + [BZ #19825] * resolv/res_send.c (send_vc): Remove early *resplen2 initialization. Set *resplen2 on socket error. Call diff --git a/resolv/nss_dns/dns-canon.c b/resolv/nss_dns/dns-canon.c index fd73f19984..072104f21c 100644 --- a/resolv/nss_dns/dns-canon.c +++ b/resolv/nss_dns/dns-canon.c @@ -103,6 +103,11 @@ _nss_dns_getcanonname_r (const char *name, char *buffer, size_t buflen, ptr += s; + /* Check that there are enough bytes for the RR + metadata. */ + if (endptr - ptr < 10) + goto unavail; + /* Check whether type and class match. */ uint_fast16_t type; NS_GET16 (type, ptr); @@ -137,11 +142,16 @@ _nss_dns_getcanonname_r (const char *name, char *buffer, size_t buflen, if (__ns_get16 (ptr) != ns_c_in) goto unavail; - /* Also skip over the TTL. */ + /* Also skip over class and TTL. */ ptr += sizeof (uint16_t) + sizeof (uint32_t); - /* Skip over the data length and data. */ - ptr += sizeof (uint16_t) + __ns_get16 (ptr); + /* Skip over RDATA length and RDATA itself. */ + uint16_t rdatalen = __ns_get16 (ptr); + ptr += sizeof (uint16_t); + /* Not enough room for RDATA. */ + if (endptr - ptr < rdatalen) + goto unavail; + ptr += rdatalen; } } diff --git a/resolv/nss_dns/dns-host.c b/resolv/nss_dns/dns-host.c index 8599f4c6a6..4bb0e6268a 100644 --- a/resolv/nss_dns/dns-host.c +++ b/resolv/nss_dns/dns-host.c @@ -751,6 +751,14 @@ getanswer_r (const querybuf *answer, int anslen, const char *qname, int qtype, cp += INT32SZ; /* TTL */ n = __ns_get16 (cp); cp += INT16SZ; /* len */ + + if (end_of_message - cp < n) + { + /* RDATA extends beyond the end of the packet. */ + ++had_error; + continue; + } + if (__glibc_unlikely (class != C_IN)) { /* XXX - debug? syslog? */ @@ -1077,6 +1085,13 @@ gaih_getanswer_slice (const querybuf *answer, int anslen, const char *qname, n = __ns_get16 (cp); cp += INT16SZ; /* len */ + if (end_of_message - cp < n) + { + /* RDATA extends beyond the end of the packet. */ + ++had_error; + continue; + } + if (class != C_IN) { cp += n; |