]> git.ipfire.org Git - thirdparty/knot-resolver.git/commit
daemon TCP to upstream: don't send wrong message length
authorVladimír Čunát <vladimir.cunat@nic.cz>
Mon, 13 May 2019 14:46:48 +0000 (16:46 +0200)
committerVladimír Čunát <vladimir.cunat@nic.cz>
Wed, 29 May 2019 15:27:23 +0000 (17:27 +0200)
commit10a113d7d4ef3188dfcb03b92e9e41111bc77343
tree9c6946c6a0b6982133c87a580b3508112b4a39ed
parenta4a29c67ab4c0798c27d7de53dac86a3d715e396
daemon TCP to upstream: don't send wrong message length

See the added comments.  Such bugs are tricky, because the old code
would typically work just fine, only if libuv/OS decided to postpone
copying the data (perhaps large load), we would send two bytes from
this address on C stack - their later value (hard to predict what).

Security risks: the two bytes might theoretically contain information
that was more or less private and we just send it to some DNS server
(possibly over unencrypted TCP), but ATM I find it very unlikely that
this bug could be practically exploited.
NEWS
daemon/worker.c