fixed an exploitable hang bug

3383.	[security]	A certain combinations of records in the RBT could
                        cause named to hang while populating the additional
                        section of a response. [RT #31090]

diff --git a/CHANGES b/CHANGES
index 431763c8b9e5532e3d15fc55d9b7eeaf480989a3..e0efad709fb0cbb90cb10bb2cf3fa2bd956dc436 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+3383.  [security]      A certain combinations of records in the RBT could
+                        cause named to hang while populating the additional
+                        section of a response. [RT #31090]
+
 3382.  [bug]           SOA query from slave used use-v6-udp-ports range,
                        if set, regardless of the address family in use.
                        [RT #24173]

diff --git a/bin/named/query.c b/bin/named/query.c
index c1a63e082d2def46d30effddd0ecdb1c77f5fc86..d0b7e696da148c1491221db79af596742a3e220c 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -1125,13 +1125,6 @@ query_isduplicate(ns_client_t *client, dns_name_t *name,
                mname = NULL;
        }
 
-       /*
-        * If the dns_name_t we're looking up is already in the message,
-        * we don't want to trigger the caller's name replacement logic.
-        */
-       if (name == mname)
-               mname = NULL;
-
        if (mnamep != NULL)
                *mnamep = mname;
 
@@ -1364,6 +1357,7 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
        if (dns_rdataset_isassociated(rdataset) &&
            !query_isduplicate(client, fname, type, &mname)) {
                if (mname != NULL) {
+                       INSIST(mname != fname);
                        query_releasename(client, &fname);
                        fname = mname;
                } else
@@ -1433,11 +1427,13 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 #endif
                        if (!query_isduplicate(client, fname,
                                               dns_rdatatype_a, &mname)) {
-                               if (mname != NULL) {
-                                       query_releasename(client, &fname);
-                                       fname = mname;
-                               } else
-                                       need_addname = ISC_TRUE;
+                               if (mname != fname) {
+                                       if (mname != NULL) {
+                                               query_releasename(client, &fname);
+                                               fname = mname;
+                                       } else
+                                               need_addname = ISC_TRUE;
+                               }
                                ISC_LIST_APPEND(fname->list, rdataset, link);
                                added_something = ISC_TRUE;
                                if (sigrdataset != NULL &&
@@ -1490,11 +1486,13 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 #endif
                        if (!query_isduplicate(client, fname,
                                               dns_rdatatype_aaaa, &mname)) {
-                               if (mname != NULL) {
-                                       query_releasename(client, &fname);
-                                       fname = mname;
-                               } else
-                                       need_addname = ISC_TRUE;
+                               if (mname != fname) {
+                                       if (mname != NULL) {
+                                               query_releasename(client, &fname);
+                                               fname = mname;
+                                       } else
+                                               need_addname = ISC_TRUE;
+                               }
                                ISC_LIST_APPEND(fname->list, rdataset, link);
                                added_something = ISC_TRUE;
                                if (sigrdataset != NULL &&
@@ -2025,22 +2023,24 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
                    crdataset->type == dns_rdatatype_aaaa) {
                        if (!query_isduplicate(client, fname, crdataset->type,
                                               &mname)) {
-                               if (mname != NULL) {
-                                       /*
-                                        * A different type of this name is
-                                        * already stored in the additional
-                                        * section.  We'll reuse the name.
-                                        * Note that this should happen at most
-                                        * once.  Otherwise, fname->link could
-                                        * leak below.
-                                        */
-                                       INSIST(mname0 == NULL);
-
-                                       query_releasename(client, &fname);
-                                       fname = mname;
-                                       mname0 = mname;
-                               } else
-                                       need_addname = ISC_TRUE;
+                               if (mname != fname) {
+                                       if (mname != NULL) {
+                                               /*
+                                                * A different type of this name is
+                                                * already stored in the additional
+                                                * section.  We'll reuse the name.
+                                                * Note that this should happen at most
+                                                * once.  Otherwise, fname->link could
+                                                * leak below.
+                                                */
+                                               INSIST(mname0 == NULL);
+
+                                               query_releasename(client, &fname);
+                                               fname = mname;
+                                               mname0 = mname;
+                                       } else
+                                               need_addname = ISC_TRUE;
+                               }
                                ISC_LIST_UNLINK(cfname.list, crdataset, link);
                                ISC_LIST_APPEND(fname->list, crdataset, link);
                                added_something = ISC_TRUE;