mollyim/unbound
1
0
Fork 0
mirror of https://github.com/mollyim/unbound.git synced 2025-05-13 05:40:36 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

- Fix for #611: Integer overflow in sldns_wire2str_pkt_scan.

Browse source
This commit is contained in:
W.C.A. Wijngaards 2022-02-03 09:03:09 +01:00
parent 50a312b8da
commit c29b0e0a96
2 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
doc/Changelog
View file

@ -1,3 +1,6 @@
3 February 2022: Wouter
- Fix for #611: Integer overflow in sldns_wire2str_pkt_scan.
2 February 2022: George 2 February 2022: George
- Merge PR #532 from Shchelk: Fix: buffer overflow bug. - Merge PR #532 from Shchelk: Fix: buffer overflow bug.
- Merge PR #616: Update ratelimit logic. It also introduces - Merge PR #616: Update ratelimit logic. It also introduces

11
sldns/wire2str.c
View file

@ -817,6 +817,7 @@ int sldns_wire2str_dname_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen,
unsigned i, counter=0; unsigned i, counter=0;
unsigned maxcompr = MAX_COMPRESS_PTRS; /* loop detection, max compr ptrs */ unsigned maxcompr = MAX_COMPRESS_PTRS; /* loop detection, max compr ptrs */
int in_buf = 1; int in_buf = 1;
size_t dname_len = 0;
if(comprloop) { if(comprloop) {
if(*comprloop != 0) if(*comprloop != 0)
maxcompr = 30; /* for like ipv6 reverse name, per label */ maxcompr = 30; /* for like ipv6 reverse name, per label */
@ -872,6 +873,16 @@ int sldns_wire2str_dname_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen,
labellen = (uint8_t)*dlen; labellen = (uint8_t)*dlen;
else if(!in_buf && pos+(size_t)labellen > pkt+pktlen) else if(!in_buf && pos+(size_t)labellen > pkt+pktlen)
labellen = (uint8_t)(pkt + pktlen - pos); labellen = (uint8_t)(pkt + pktlen - pos);
dname_len += ((size_t)labellen)+1;
if(dname_len > LDNS_MAX_DOMAINLEN) {
/* dname_len counts the uncompressed length we have
* seen so far, and the domain name has become too
* long, prevent the loop from printing overly long
* content. */
w += sldns_str_print(s, slen,
"ErrorDomainNameTooLong");
return w;
}
for(i=0; i<(unsigned)labellen; i++) { for(i=0; i<(unsigned)labellen; i++) {
w += dname_char_print(s, slen, *pos++); w += dname_char_print(s, slen, *pos++);
} }