Limit isccc_cc_fromwire recursion depth

Named and rndc do not need a lot of recursion so the depth is
set to 10.

(cherry picked from commit 820b0cceef0b67b041973da4041ea53d5e276363)

diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c
index e012685b5ad31e49c0e1993aca73b96b21bc293a..7e1a6cd6d3fd72935be69b2724afee40d5056d1e 100644 (file)
--- a/lib/isccc/cc.c
+++ b/lib/isccc/cc.c
@@ -51,8 +51,12 @@
 #include <isccc/symtype.h>
 #include <isccc/util.h>
 
-#define MAX_TAGS               256
-#define DUP_LIFETIME           900
+#define MAX_TAGS     256
+#define DUP_LIFETIME 900
+#ifndef ISCCC_MAXDEPTH
+#define ISCCC_MAXDEPTH \
+       10 /* Big enough for rndc which just sends a string each way. */
+#endif
 
 typedef isccc_sexpr_t *sexpr_ptr;
 
@@ -561,21 +565,28 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
 
 static isc_result_t
 table_fromwire(isccc_region_t *source, isccc_region_t *secret,
-              uint32_t algorithm, isccc_sexpr_t **alistp);
+              uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp);
 
 static isc_result_t
-list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp);
+list_fromwire(isccc_region_t *source, unsigned int depth,
+             isccc_sexpr_t **listp);
 
 static isc_result_t
-value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
+value_fromwire(isccc_region_t *source, unsigned int depth,
+              isccc_sexpr_t **valuep) {
        unsigned int msgtype;
        uint32_t len;
        isccc_sexpr_t *value;
        isccc_region_t active;
        isc_result_t result;
 
-       if (REGION_SIZE(*source) < 1 + 4)
+       if (depth > ISCCC_MAXDEPTH) {
+               return (ISCCC_R_MAXDEPTH);
+       }
+
+       if (REGION_SIZE(*source) < 1 + 4) {
                return (ISC_R_UNEXPECTEDEND);
+       }
        GET8(msgtype, source->rstart);
        GET32(len, source->rstart);
        if (REGION_SIZE(*source) < len)
@@ -588,22 +599,23 @@ value_fromwire(isccc_region_t *source, isccc_sexpr_t **valuep) {
                if (value != NULL) {
                        *valuep = value;
                        result = ISC_R_SUCCESS;
-               } else
+               } else {
                        result = ISC_R_NOMEMORY;
-       } else if (msgtype == ISCCC_CCMSGTYPE_TABLE)
-               result = table_fromwire(&active, NULL, 0, valuep);
-       else if (msgtype == ISCCC_CCMSGTYPE_LIST)
-               result = list_fromwire(&active, valuep);
-       else
+               }
+       } else if (msgtype == ISCCC_CCMSGTYPE_TABLE) {
+               result = table_fromwire(&active, NULL, 0, depth + 1, valuep);
+       } else if (msgtype == ISCCC_CCMSGTYPE_LIST) {
+               result = list_fromwire(&active, depth + 1, valuep);
+       } else {
                result = ISCCC_R_SYNTAX;
+       }
 
        return (result);
 }
 
 static isc_result_t
 table_fromwire(isccc_region_t *source, isccc_region_t *secret,
-              uint32_t algorithm, isccc_sexpr_t **alistp)
-{
+              uint32_t algorithm, unsigned int depth, isccc_sexpr_t **alistp) {
        char key[256];
        uint32_t len;
        isc_result_t result;
@@ -613,6 +625,10 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
 
        REQUIRE(alistp != NULL && *alistp == NULL);
 
+       if (depth > ISCCC_MAXDEPTH) {
+               return (ISCCC_R_MAXDEPTH);
+       }
+
        checksum_rstart = NULL;
        first_tag = true;
        alist = isccc_alist_create();
@@ -628,9 +644,10 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
                GET_MEM(key, len, source->rstart);
                key[len] = '\0';        /* Ensure NUL termination. */
                value = NULL;
-               result = value_fromwire(source, &value);
-               if (result != ISC_R_SUCCESS)
+               result = value_fromwire(source, depth + 1, &value);
+               if (result != ISC_R_SUCCESS) {
                        goto bad;
+               }
                if (isccc_alist_define(alist, key, value) == NULL) {
                        result = ISC_R_NOMEMORY;
                        goto bad;
@@ -661,14 +678,19 @@ table_fromwire(isccc_region_t *source, isccc_region_t *secret,
 }
 
 static isc_result_t
-list_fromwire(isccc_region_t *source, isccc_sexpr_t **listp) {
+list_fromwire(isccc_region_t *source, unsigned int depth,
+             isccc_sexpr_t **listp) {
        isccc_sexpr_t *list, *value;
        isc_result_t result;
 
+       if (depth > ISCCC_MAXDEPTH) {
+               return (ISCCC_R_MAXDEPTH);
+       }
+
        list = NULL;
        while (!REGION_EMPTY(*source)) {
                value = NULL;
-               result = value_fromwire(source, &value);
+               result = value_fromwire(source, depth + 1, &value);
                if (result != ISC_R_SUCCESS) {
                        isccc_sexpr_free(&list);
                        return (result);
@@ -699,7 +721,7 @@ isccc_cc_fromwire(isccc_region_t *source, isccc_sexpr_t **alistp,
        if (version != 1)
                return (ISCCC_R_UNKNOWNVERSION);
 
-       return (table_fromwire(source, secret, algorithm, alistp));
+       return (table_fromwire(source, secret, algorithm, 0, alistp));
 }
 
 static isc_result_t

diff --git a/lib/isccc/include/isccc/result.h b/lib/isccc/include/isccc/result.h
index 6c79dd716a4ead8e8e39872077a50fe842cfbf14..b30b08a64843cb8f38bdde4a85610ef95eab58e3 100644 (file)
--- a/lib/isccc/include/isccc/result.h
+++ b/lib/isccc/include/isccc/result.h
@@ -47,8 +47,10 @@
 #define ISCCC_R_CLOCKSKEW              (ISC_RESULTCLASS_ISCCC + 4)
 /*% Duplicate */
 #define ISCCC_R_DUPLICATE              (ISC_RESULTCLASS_ISCCC + 5)
+/*% Maximum recursion depth */
+#define ISCCC_R_MAXDEPTH               (ISC_RESULTCLASS_ISCCC + 6)
 
-#define ISCCC_R_NRESULTS               6       /*%< Number of results */
+#define ISCCC_R_NRESULTS               7       /*%< Number of results */
 
 ISC_LANG_BEGINDECLS
 

diff --git a/lib/isccc/result.c b/lib/isccc/result.c
index 8419bbb871e610acf7092d27b5e1282c220ebccc..1ebd5d485ac4c19b2daff578a7d2e84187212ede 100644 (file)
--- a/lib/isccc/result.c
+++ b/lib/isccc/result.c
@@ -40,7 +40,8 @@ static const char *text[ISCCC_R_NRESULTS] = {
        "bad auth",                             /* 3 */
        "expired",                              /* 4 */
        "clock skew",                           /* 5 */
-       "duplicate"                             /* 6 */
+       "duplicate",                            /* 6 */
+       "max depth"                             /* 7 */
 };
 
 static const char *ids[ISCCC_R_NRESULTS] = {
@@ -50,6 +51,7 @@ static const char *ids[ISCCC_R_NRESULTS] = {
        "ISCCC_R_EXPIRED",
        "ISCCC_R_CLOCKSKEW",
        "ISCCC_R_DUPLICATE",
+       "ISCCC_R_MAXDEPTH",
 };
 
 #define ISCCC_RESULT_RESULTSET                 2