]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG: dns: Prevent stack-exhaustion via recursion loop in dns_read_name
authorRemi Gacogne <remi.gacogne@powerdns.com>
Wed, 5 Dec 2018 16:52:54 +0000 (17:52 +0100)
committerWilly Tarreau <w@1wt.eu>
Wed, 12 Dec 2018 13:43:25 +0000 (14:43 +0100)
commit58df5aea0a0c926b2238f65908f5e9f83d1cca25
treea37f0f9ef4ffc8b2a80ebf0d1aed6cd3eef7f878
parentadb222004120a3ab242d04469e08e44d8ae9c35b
BUG: dns: Prevent stack-exhaustion via recursion loop in dns_read_name

When a compressed pointer is encountered, dns_read_name() will call
itself with the pointed-to offset in the packet.
With a specially crafted packet, it was possible to trigger an
infinite-loop recursion by making the pointer points to itself.
While it would be possible to handle that particular case differently
by making sure that the target is different from the current offset,
it would still be possible to craft a packet with a very long chain
of valid pointers, always pointing backwards. To prevent a stack
exhaustion in that case, this patch restricts the number of recursive
calls to 100, which should be more than enough.

To be backported to 1.8, probably also 1.7.
src/dns.c