- Fix Integer Overflows in Size Calculations,

  reported by X41 D-Sec.

diff --git a/dnscrypt/dnscrypt.c b/dnscrypt/dnscrypt.c
index 2b38a1cdbba8be123cfdf1164741f3e7ee4d8cf3..72a9527f5652a8ed0b82a2a2cfc461d34d028c1d 100644 (file)
--- a/dnscrypt/dnscrypt.c
+++ b/dnscrypt/dnscrypt.c
@@ -732,6 +732,11 @@ dnsc_load_local_data(struct dnsc_env* dnscenv, struct config_file *cfg)
             );
             continue;
         }
+       if((unsigned)strlen(dnscenv->provider_name) >= (unsigned)0xffff0000) {
+               /* guard against integer overflow in rrlen calculation */
+               verbose(VERB_OPS, "cert #%" PRIu32 " is too long", serial);
+               continue
+       }
         rrlen = strlen(dnscenv->provider_name) +
                          strlen(ttl_class_type) +
                          4 * sizeof(struct SignedCert) + // worst case scenario

diff --git a/doc/Changelog b/doc/Changelog
index 9803ae8ccca41a2d1788eb324db4369de8f8a24b..7398075e1235987fa3afae29c1fa8f93edba4d24 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -9,6 +9,8 @@
          and ipsecmod_new(), reported by X41 D-Sec.
        - Fix Out-of-bounds Read in rr_comment_dnskey(),
          reported by X41 D-Sec.
+       - Fix Integer Overflows in Size Calculations,
+         reported by X41 D-Sec.
 
 18 November 2019: Wouter
        - In unbound-host use separate variable for get_option to please

diff --git a/respip/respip.c b/respip/respip.c
index 36a1c9726bd07bdc781897ebe52d1d9c669bb901..482762b508a6fd641284aeea376eddb5fb390d4c 100644 (file)
--- a/respip/respip.c
+++ b/respip/respip.c
@@ -479,10 +479,16 @@ copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region)
        if(!ck->rk.dname)
                return NULL;
 
+       if((unsigned)data->count >= 0xffff00U)
+               return NULL; /* guard against integer overflow in dsize */
        dsize = sizeof(struct packed_rrset_data) + data->count *
                (sizeof(size_t)+sizeof(uint8_t*)+sizeof(time_t));
-       for(i=0; i<data->count; i++)
+       for(i=0; i<data->count; i++) {
+               if((unsigned)dsize >= 0x0fffffffU ||
+                       (unsigned)data->rr_len[i] >= 0x0fffffffU)
+                       return NULL; /* guard against integer overflow */
                dsize += data->rr_len[i];
+       }
        d = regional_alloc(region, dsize);
        if(!d)
                return NULL;