From: Mark Andrews <marka@isc.org>
Date: Tue, 25 Aug 2020 12:59:35 +0000 (+1000)
Subject: Cast the original rcode to (dns_ttl_t) when setting extended rcode
X-Git-Tag: v9.17.5~33^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a347641782dfb47aa45e6e8ffc9e0c6db4c07deb;p=thirdparty%2Fbind9.git

Cast the original rcode to (dns_ttl_t) when setting extended rcode

Shifting (signed) integer left could trigger undefined behaviour when
the shifted value would overflow into the sign bit (e.g. 2048).

The issue was found when using AFL++ and UBSAN:

    message.c:2274:33: runtime error: left shift of 2048 by 20 places cannot be represented in type 'int'
    SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior message.c:2274:33 in
---

diff --git a/lib/dns/message.c b/lib/dns/message.c
index 97425c753b7..c819957ae20 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -2268,10 +2268,11 @@ dns_message_renderend(dns_message_t *msg) {
 		dns_message_renderrelease(msg, msg->opt_reserved);
 		msg->opt_reserved = 0;
 		/*
-		 * Set the extended rcode.
+		 * Set the extended rcode.  Cast msg->rcode to dns_ttl_t
+		 * so that we do a unsigned shift.
 		 */
 		msg->opt->ttl &= ~DNS_MESSAGE_EDNSRCODE_MASK;
-		msg->opt->ttl |= ((msg->rcode << 20) &
+		msg->opt->ttl |= (((dns_ttl_t)(msg->rcode) << 20) &
 				  DNS_MESSAGE_EDNSRCODE_MASK);
 		/*
 		 * Render.