]> git.ipfire.org Git - thirdparty/haproxy.git/commit
BUG: dns: Prevent out-of-bounds read in dns_validate_dns_response()
authorRemi Gacogne <remi.gacogne@powerdns.com>
Wed, 5 Dec 2018 16:56:29 +0000 (17:56 +0100)
committerWilly Tarreau <w@1wt.eu>
Wed, 12 Dec 2018 13:44:29 +0000 (14:44 +0100)
commitefbbdf72992cd20458259962346044cafd9331c0
tree8eb99af431453a26c1da8839ba1d9377287eba37
parent2d19fbcab21356f5aee1f2a52591a38665360bb6
BUG: dns: Prevent out-of-bounds read in dns_validate_dns_response()

We need to make sure that the record length is not making us read
past the end of the data we received.
Before this patch we could for example read the 16 bytes
corresponding to an AAAA record from the non-initialized part of
the buffer, possibly accessing anything that was left on the stack,
or even past the end of the 8193-byte buffer, depending on the
value of accepted_payload_size.

To be backported to 1.8, probably also 1.7.
src/dns.c