- Fix Assert Causing DoS in synth_cname(),

  reported by X41 D-Sec.

diff --git a/doc/Changelog b/doc/Changelog
index 0bca5d9ef720ede09433dddd7ddd8bdb991b5eb3..59541fa34237b7707d66517917f8c9ca0584909f 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -3,6 +3,8 @@
          from 'quick' to 'basic' because this is an I/O lock.
        - Fix text around serial arithmatic used for RRSIG times to refer
          to correct RFC number.
+       - Fix Assert Causing DoS in synth_cname(),
+         reported by X41 D-Sec.
 
 2 December 2019: Wouter
        - Merge pull request #122 from he32: In tcp_callback_writer(),

diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c
index 3f1438a4ff3d553422181d5dc14a9a434b037128..cceec3d5677a59c5c62f6cb2fd736ed71d07a575 100644 (file)
--- a/iterator/iter_scrub.c
+++ b/iterator/iter_scrub.c
@@ -217,6 +217,10 @@ synth_cname(uint8_t* qname, size_t qnamelen, struct rrset_parse* dname_rrset,
        size_t dtarglen;
        if(!parse_get_cname_target(dname_rrset, &dtarg, &dtarglen))
                return 0; 
+       if(qnamelen <= dname_rrset->dname_len)
+               return 0;
+       if(qnamelen == 0)
+               return 0;
        log_assert(qnamelen > dname_rrset->dname_len);
        /* DNAME from com. to net. with qname example.com. -> example.net. */
        /* so: \3com\0 to \3net\0 and qname \7example\3com\0 */