From: Willy Tarreau <w@1wt.eu>
Date: Tue, 22 Aug 2017 10:01:26 +0000 (+0200)
Subject: BUG/MEDIUM: dns: fix accepted_payload_size parser to avoid integer overflow
X-Git-Tag: v1.8-dev3~158
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0c219be3dffa85b936048cc6b0ca45f3cf684d23;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: dns: fix accepted_payload_size parser to avoid integer overflow

Since commit 9d8dbbc ("MINOR: dns: Maximum DNS udp payload set to 8192") it's
possible to specify a packet size, but passing too large a size or a negative
size is not detected and results in memset() being performed over a 2GB+ area
upon receipt of the first DNS response, causing runtime crashes.

We now check that the size is not smaller than the smallest packet which is
the DNS header size (12 bytes).

No backport is needed.
---

diff --git a/include/types/dns.h b/include/types/dns.h
index c7338c7924..06e014c089 100644
--- a/include/types/dns.h
+++ b/include/types/dns.h
@@ -82,7 +82,7 @@
 #define SRV_MAX_PREF_NET 5
 
 /* DNS header size */
-#define DNS_HEADER_SIZE		sizeof(struct dns_header)
+#define DNS_HEADER_SIZE		((int)sizeof(struct dns_header))
 
 /* DNS resolution pool size, per resolvers section */
 #define DNS_DEFAULT_RESOLUTION_POOL_SIZE	64
diff --git a/src/cfgparse.c b/src/cfgparse.c
index e69a4ab78b..850160f6ec 100644
--- a/src/cfgparse.c
+++ b/src/cfgparse.c
@@ -2304,9 +2304,9 @@ int cfg_parse_resolvers(const char *file, int linenum, char **args, int kwm)
 		}
 
 		i = atoi(args[1]);
-		if (i > DNS_MAX_UDP_MESSAGE) {
-			Alert("parsing [%s:%d] : '%s' size %d exceeds maximum allowed size %d.\n",
-				file, linenum, args[0], i, DNS_MAX_UDP_MESSAGE);
+		if (i < DNS_HEADER_SIZE || i > DNS_MAX_UDP_MESSAGE) {
+			Alert("parsing [%s:%d] : '%s' must be between %d and %d inclusive (was %s).\n",
+			      file, linenum, args[0], DNS_HEADER_SIZE, DNS_MAX_UDP_MESSAGE, args[1]);
 			err_code |= ERR_ALERT | ERR_FATAL;
 			goto out;
 		}