nss_dns: Validate RDATA length against packet length [BZ #19830]

In _nss_dns_getcanonname_r, a check for the availability of RR metadata
was missing as well.

diff --git a/ChangeLog b/ChangeLog
index 954c95f9a93f8531e4983069fd719e8243db567e..081994cf6f958da93d00def254c87fb40331770b 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2016-04-27  Florian Weimer  <fweimer@redhat.com>
+
+       [BZ #19830]
+       * resolv/nss_dns/dns-host.c (getanswer_r): Check RDATA length.
+       (gaih_getanswer_slice): Likewise.
+       * resolv/nss_dns/dns-canon.c (_nss_dns_getcanonname_r): Likewise.
+       Also check for availability of RR metadata.
+
 2016-04-27  Florian Weimer  <fweimer@redhat.com>
 
        [BZ #19825]

diff --git a/resolv/nss_dns/dns-canon.c b/resolv/nss_dns/dns-canon.c
index fd73f19984c45cf14f67fb17891541b12599980e..072104f21cc411c0eac5521368804b221c985108 100644 (file)
--- a/resolv/nss_dns/dns-canon.c
+++ b/resolv/nss_dns/dns-canon.c
@@ -103,6 +103,11 @@ _nss_dns_getcanonname_r (const char *name, char *buffer, size_t buflen,
 
              ptr += s;
 
+             /* Check that there are enough bytes for the RR
+                metadata.  */
+             if (endptr - ptr < 10)
+               goto unavail;
+
              /* Check whether type and class match.  */
              uint_fast16_t type;
              NS_GET16 (type, ptr);
@@ -137,11 +142,16 @@ _nss_dns_getcanonname_r (const char *name, char *buffer, size_t buflen,
              if (__ns_get16 (ptr) != ns_c_in)
                goto unavail;
 
-             /* Also skip over the TTL.  */
+             /* Also skip over class and TTL.  */
              ptr += sizeof (uint16_t) + sizeof (uint32_t);
 
-             /* Skip over the data length and data.  */
-             ptr += sizeof (uint16_t) + __ns_get16 (ptr);
+             /* Skip over RDATA length and RDATA itself.  */
+             uint16_t rdatalen = __ns_get16 (ptr);
+             ptr += sizeof (uint16_t);
+             /* Not enough room for RDATA.  */
+             if (endptr - ptr < rdatalen)
+               goto unavail;
+             ptr += rdatalen;
            }
        }
 

diff --git a/resolv/nss_dns/dns-host.c b/resolv/nss_dns/dns-host.c
index 8599f4c6a6ef2781e3fc8450314ede746208fc3d..4bb0e6268a17c7e9cf40656f6b70f9ac8677429f 100644 (file)
--- a/resolv/nss_dns/dns-host.c
+++ b/resolv/nss_dns/dns-host.c
@@ -751,6 +751,14 @@ getanswer_r (const querybuf *answer, int anslen, const char *qname, int qtype,
       cp += INT32SZ;                   /* TTL */
       n = __ns_get16 (cp);
       cp += INT16SZ;                   /* len */
+
+      if (end_of_message - cp < n)
+       {
+         /* RDATA extends beyond the end of the packet.  */
+         ++had_error;
+         continue;
+       }
+
       if (__glibc_unlikely (class != C_IN))
        {
          /* XXX - debug? syslog? */
@@ -1077,6 +1085,13 @@ gaih_getanswer_slice (const querybuf *answer, int anslen, const char *qname,
       n = __ns_get16 (cp);
       cp += INT16SZ;                   /* len */
 
+      if (end_of_message - cp < n)
+       {
+         /* RDATA extends beyond the end of the packet.  */
+         ++had_error;
+         continue;
+       }
+
       if (class != C_IN)
        {
          cp += n;