From efbbdf72992cd20458259962346044cafd9331c0 Mon Sep 17 00:00:00 2001 From: Remi Gacogne Date: Wed, 5 Dec 2018 17:56:29 +0100 Subject: [PATCH] BUG: dns: Prevent out-of-bounds read in dns_validate_dns_response() We need to make sure that the record length is not making us read past the end of the data we received. Before this patch we could for example read the 16 bytes corresponding to an AAAA record from the non-initialized part of the buffer, possibly accessing anything that was left on the stack, or even past the end of the 8193-byte buffer, depending on the value of accepted_payload_size. To be backported to 1.8, probably also 1.7. --- src/dns.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/dns.c b/src/dns.c index fead2613ad..c1396f5259 100644 --- a/src/dns.c +++ b/src/dns.c @@ -810,6 +810,11 @@ static int dns_validate_dns_response(unsigned char *resp, unsigned char *bufend, /* Move forward 2 bytes for data len */ reader += 2; + if (reader + dns_answer_record->data_len >= bufend) { + pool_free(dns_answer_item_pool, dns_answer_record); + return DNS_RESP_INVALID; + } + /* Analyzing record content */ switch (dns_answer_record->type) { case DNS_RTYPE_A: -- 2.39.5