This is the mail archive of the glibc-cvs@sourceware.org mailing list for the glibc project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

GNU C Library master sources branch master updated. glibc-2.23-245-gf749498


This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, master has been updated
       via  f749498fa53df9ead81e291cd9378d67483c2452 (commit)
      from  b9bdfa7c8fa22c944bb5f21a673dfd1f91b71c56 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
http://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=f749498fa53df9ead81e291cd9378d67483c2452

commit f749498fa53df9ead81e291cd9378d67483c2452
Author: Florian Weimer <fweimer@redhat.com>
Date:   Wed Apr 27 15:11:41 2016 +0200

    nss_dns: Validate RDATA length against packet length [BZ #19830]
    
    In _nss_dns_getcanonname_r, a check for the availability of RR metadata
    was missing as well.

diff --git a/ChangeLog b/ChangeLog
index 954c95f..081994c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
 2016-04-27  Florian Weimer  <fweimer@redhat.com>
 
+	[BZ #19830]
+	* resolv/nss_dns/dns-host.c (getanswer_r): Check RDATA length.
+	(gaih_getanswer_slice): Likewise.
+	* resolv/nss_dns/dns-canon.c (_nss_dns_getcanonname_r): Likewise.
+	Also check for availability of RR metadata.
+
+2016-04-27  Florian Weimer  <fweimer@redhat.com>
+
 	[BZ #19825]
 	* resolv/res_send.c (send_vc): Remove early *resplen2
 	initialization.  Set *resplen2 on socket error.  Call
diff --git a/resolv/nss_dns/dns-canon.c b/resolv/nss_dns/dns-canon.c
index fd73f19..072104f 100644
--- a/resolv/nss_dns/dns-canon.c
+++ b/resolv/nss_dns/dns-canon.c
@@ -103,6 +103,11 @@ _nss_dns_getcanonname_r (const char *name, char *buffer, size_t buflen,
 
 	      ptr += s;
 
+	      /* Check that there are enough bytes for the RR
+		 metadata.  */
+	      if (endptr - ptr < 10)
+		goto unavail;
+
 	      /* Check whether type and class match.  */
 	      uint_fast16_t type;
 	      NS_GET16 (type, ptr);
@@ -137,11 +142,16 @@ _nss_dns_getcanonname_r (const char *name, char *buffer, size_t buflen,
 	      if (__ns_get16 (ptr) != ns_c_in)
 		goto unavail;
 
-	      /* Also skip over the TTL.  */
+	      /* Also skip over class and TTL.  */
 	      ptr += sizeof (uint16_t) + sizeof (uint32_t);
 
-	      /* Skip over the data length and data.  */
-	      ptr += sizeof (uint16_t) + __ns_get16 (ptr);
+	      /* Skip over RDATA length and RDATA itself.  */
+	      uint16_t rdatalen = __ns_get16 (ptr);
+	      ptr += sizeof (uint16_t);
+	      /* Not enough room for RDATA.  */
+	      if (endptr - ptr < rdatalen)
+		goto unavail;
+	      ptr += rdatalen;
 	    }
 	}
 
diff --git a/resolv/nss_dns/dns-host.c b/resolv/nss_dns/dns-host.c
index 8599f4c..4bb0e62 100644
--- a/resolv/nss_dns/dns-host.c
+++ b/resolv/nss_dns/dns-host.c
@@ -751,6 +751,14 @@ getanswer_r (const querybuf *answer, int anslen, const char *qname, int qtype,
       cp += INT32SZ;			/* TTL */
       n = __ns_get16 (cp);
       cp += INT16SZ;			/* len */
+
+      if (end_of_message - cp < n)
+	{
+	  /* RDATA extends beyond the end of the packet.  */
+	  ++had_error;
+	  continue;
+	}
+
       if (__glibc_unlikely (class != C_IN))
 	{
 	  /* XXX - debug? syslog? */
@@ -1077,6 +1085,13 @@ gaih_getanswer_slice (const querybuf *answer, int anslen, const char *qname,
       n = __ns_get16 (cp);
       cp += INT16SZ;			/* len */
 
+      if (end_of_message - cp < n)
+	{
+	  /* RDATA extends beyond the end of the packet.  */
+	  ++had_error;
+	  continue;
+	}
+
       if (class != C_IN)
 	{
 	  cp += n;

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                  |    8 ++++++++
 resolv/nss_dns/dns-canon.c |   16 +++++++++++++---
 resolv/nss_dns/dns-host.c  |   15 +++++++++++++++
 3 files changed, 36 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
GNU C Library master sources


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]