- Fix for repeated use of a DNAME record: first overallocate and then

  move the exact size of the init value to avoid false positive heap
  overflow reads from address sanitizers.

diff --git a/doc/Changelog b/doc/Changelog
index 101e807541907904e9cc64f78aad2b6710b26bb4..c7fe7982f47ac8920813acf18fb94997d965a50f 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,8 @@
+3 July 2024: Yorgos
+       - Fix for repeated use of a DNAME record: first overallocate and then
+         move the exact size of the init value to avoid false positive heap
+         overflow reads from address sanitizers.
+
 2 July 2024: Wouter
        - Fix to remove unused include from the readzone test program.
        - Fix unused variable warning in do_cache_remove.

diff --git a/validator/validator.c b/validator/validator.c
index ec656db127b816c6fa9b94cac80718df739ed687..e608b9a0eec3af1369421a795cc700eb797b78c4 100644 (file)
--- a/validator/validator.c
+++ b/validator/validator.c
@@ -273,11 +273,17 @@ val_new_getmsg(struct module_qstate* qstate, struct val_qstate* vq)
                return NULL;
        if(vq->orig_msg->rep->rrset_count > RR_COUNT_MAX)
                return NULL; /* protect against integer overflow */
-       vq->chase_reply->rrsets = regional_alloc_init(qstate->region,
-               vq->orig_msg->rep->rrsets, sizeof(struct ub_packed_rrset_key*)
-                       * (vq->orig_msg->rep->rrset_count + vq->orig_msg->rep->an_numrrsets /* for extra DNAME records for unsigned CNAME repetitions*/) );
+       /* Over allocate (+an_numrrsets) in case we need to put extra DNAME
+        * records for unsigned CNAME repetitions */
+       vq->chase_reply->rrsets = regional_alloc(qstate->region,
+               sizeof(struct ub_packed_rrset_key*) *
+               (vq->orig_msg->rep->rrset_count
+               + vq->orig_msg->rep->an_numrrsets));
        if(!vq->chase_reply->rrsets)
                return NULL;
+       memmove(vq->chase_reply->rrsets, vq->orig_msg->rep->rrsets,
+               sizeof(struct ub_packed_rrset_key*) *
+               vq->orig_msg->rep->rrset_count);
        vq->rrset_skip = 0;
        return vq;
 }