Skip to content

Commit 308fdba

Browse files
bagderbagder
committed
1 parent 5e6fd0a commit 308fdba

File tree

1 file changed

+163
-0
lines changed

1 file changed

+163
-0
lines changed

‎CVE-2016-5180.patch

+163
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
From 115fe381c75147352d7a8d21aa3ffb85ca367219 Mon Sep 17 00:00:00 2001
2+
From: Daniel Stenberg <[email protected]>
3+
Date: Fri, 23 Sep 2016 14:44:11 +0200
4+
Subject: [PATCH] ares_create_query: avoid single-byte buffer overwrite
5+
6+
... when the name ends with an escaped dot.
7+
8+
CVE-2016-5180
9+
10+
Bug: https://c-ares.haxx.se/adv_20160929.html
11+
---
12+
ares_create_query.c | 84 +++++++++++++++++++++++++----------------------------
13+
1 file changed, 39 insertions(+), 45 deletions(-)
14+
15+
diff --git a/ares_create_query.c b/ares_create_query.c
16+
index a34dda7..7f4c52d 100644
17+
--- a/ares_create_query.c
18+
+++ b/ares_create_query.c
19+
@@ -83,61 +83,35 @@
20+
* label. The list is terminated by a label of length zero (which can
21+
* be thought of as the root domain).
22+
*/
23+
24+
int ares_create_query(const char *name, int dnsclass, int type,
25+
- unsigned short id, int rd, unsigned char **buf,
26+
- int *buflen, int max_udp_size)
27+
+ unsigned short id, int rd, unsigned char **bufp,
28+
+ int *buflenp, int max_udp_size)
29+
{
30+
- int len;
31+
+ size_t len;
32+
unsigned char *q;
33+
const char *p;
34+
+ size_t buflen;
35+
+ unsigned char *buf;
36+
37+
/* Set our results early, in case we bail out early with an error. */
38+
- *buflen = 0;
39+
- *buf = NULL;
40+
+ *buflenp = 0;
41+
+ *bufp = NULL;
42+
43+
- /* Compute the length of the encoded name so we can check buflen.
44+
- * Start counting at 1 for the zero-length label at the end. */
45+
- len = 1;
46+
- for (p = name; *p; p++)
47+
- {
48+
- if (*p == '\\' && *(p + 1) != 0)
49+
- p++;
50+
- len++;
51+
- }
52+
- /* If there are n periods in the name, there are n + 1 labels, and
53+
- * thus n + 1 length fields, unless the name is empty or ends with a
54+
- * period. So add 1 unless name is empty or ends with a period.
55+
+ /* Allocate a memory area for the maximum size this packet might need. +2
56+
+ * is for the length byte and zero termination if no dots or ecscaping is
57+
+ * used.
58+
*/
59+
- if (*name && *(p - 1) != '.')
60+
- len++;
61+
-
62+
- /* Immediately reject names that are longer than the maximum of 255
63+
- * bytes that's specified in RFC 1035 ("To simplify implementations,
64+
- * the total length of a domain name (i.e., label octets and label
65+
- * length octets) is restricted to 255 octets or less."). We aren't
66+
- * doing this just to be a stickler about RFCs. For names that are
67+
- * too long, 'dnscache' closes its TCP connection to us immediately
68+
- * (when using TCP) and ignores the request when using UDP, and
69+
- * BIND's named returns ServFail (TCP or UDP). Sending a request
70+
- * that we know will cause 'dnscache' to close the TCP connection is
71+
- * painful, since that makes any other outstanding requests on that
72+
- * connection fail. And sending a UDP request that we know
73+
- * 'dnscache' will ignore is bad because resources will be tied up
74+
- * until we time-out the request.
75+
- */
76+
- if (len > MAXCDNAME)
77+
- return ARES_EBADNAME;
78+
-
79+
- *buflen = len + HFIXEDSZ + QFIXEDSZ + (max_udp_size ? EDNSFIXEDSZ : 0);
80+
- *buf = ares_malloc(*buflen);
81+
- if (!*buf)
82+
- return ARES_ENOMEM;
83+
+ len = strlen(name) + 2 + HFIXEDSZ + QFIXEDSZ +
84+
+ (max_udp_size ? EDNSFIXEDSZ : 0);
85+
+ buf = ares_malloc(len);
86+
+ if (!buf)
87+
+ return ARES_ENOMEM;
88+
89+
/* Set up the header. */
90+
- q = *buf;
91+
+ q = buf;
92+
memset(q, 0, HFIXEDSZ);
93+
DNS_HEADER_SET_QID(q, id);
94+
DNS_HEADER_SET_OPCODE(q, QUERY);
95+
if (rd) {
96+
DNS_HEADER_SET_RD(q, 1);
97+
@@ -157,23 +131,27 @@ int ares_create_query(const char *name, int dnsclass, int type,
98+
99+
/* Start writing out the name after the header. */
100+
q += HFIXEDSZ;
101+
while (*name)
102+
{
103+
- if (*name == '.')
104+
+ if (*name == '.') {
105+
+ free (buf);
106+
return ARES_EBADNAME;
107+
+ }
108+
109+
/* Count the number of bytes in this label. */
110+
len = 0;
111+
for (p = name; *p && *p != '.'; p++)
112+
{
113+
if (*p == '\\' && *(p + 1) != 0)
114+
p++;
115+
len++;
116+
}
117+
- if (len > MAXLABEL)
118+
+ if (len > MAXLABEL) {
119+
+ free (buf);
120+
return ARES_EBADNAME;
121+
+ }
122+
123+
/* Encode the length and copy the data. */
124+
*q++ = (unsigned char)len;
125+
for (p = name; *p && *p != '.'; p++)
126+
{
127+
@@ -193,16 +171,32 @@ int ares_create_query(const char *name, int dnsclass, int type,
128+
129+
/* Finish off the question with the type and class. */
130+
DNS_QUESTION_SET_TYPE(q, type);
131+
DNS_QUESTION_SET_CLASS(q, dnsclass);
132+
133+
+ q += QFIXEDSZ;
134+
if (max_udp_size)
135+
{
136+
- q += QFIXEDSZ;
137+
memset(q, 0, EDNSFIXEDSZ);
138+
q++;
139+
DNS_RR_SET_TYPE(q, T_OPT);
140+
DNS_RR_SET_CLASS(q, max_udp_size);
141+
+ q += (EDNSFIXEDSZ-1);
142+
+ }
143+
+ buflen = (q - buf);
144+
+
145+
+ /* Reject names that are longer than the maximum of 255 bytes that's
146+
+ * specified in RFC 1035 ("To simplify implementations, the total length of
147+
+ * a domain name (i.e., label octets and label length octets) is restricted
148+
+ * to 255 octets or less."). */
149+
+ if (buflen > (MAXCDNAME + HFIXEDSZ + QFIXEDSZ +
150+
+ (max_udp_size ? EDNSFIXEDSZ : 0))) {
151+
+ free (buf);
152+
+ return ARES_EBADNAME;
153+
}
154+
155+
+ /* we know this fits in an int at this point */
156+
+ *buflenp = (int) buflen;
157+
+ *bufp = buf;
158+
+
159+
return ARES_SUCCESS;
160+
}
161+
--
162+
2.9.3
163+

0 commit comments

Comments
 (0)