]> git.ipfire.org Git - thirdparty/pdns.git/commit
Don't read potentially uninitalized memory if gethostname() failed 9114/head
authorRemi Gacogne <remi.gacogne@powerdns.com>
Mon, 17 Feb 2020 14:20:32 +0000 (15:20 +0100)
committerOtto Moerbeek <otto.moerbeek@open-xchange.com>
Wed, 13 May 2020 09:39:02 +0000 (11:39 +0200)
commite7a0f37ce6729711b647ddea610f8b655a5d3732
treed68fbe1eb448351a94e13767e16109531483b686
parent4bba0ec04aacbec08fe585ad790e2e8e0cb7b04a
Don't read potentially uninitalized memory if gethostname() failed

If the buffer is smaller than `HOST_NAME_MAX` (64 on Linux but up to
255 bytes in POSIX, which FreeBSD, MacOS etc honor) gethostname()
might return -1 without null-terminating the buffer, causing an
out-of-bounds read.
As we look for the first '.' using `strchr()`, replacing it with a
null byte, we also have a one-byte out-of-bounds write which might
result in a crash or, albeit very unlikely, arbitrary code execution.
pdns/auth-carbon.cc
pdns/dnsdist-carbon.cc
pdns/rec-carbon.cc