4285. [security] Specific APL data could trigger a INSIST.

                        (CVE-2015-8704) [RT #41396]

diff --git a/CHANGES b/CHANGES
index 01af9bda639d044a561f3d5505c8ec8a59d3d9e5..1ea58e2f4f8e97d0cb47350233b61e435a1198cc 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4285.  [security]      Specific APL data could trigger a INSIST.
+                       (CVE-2015-8704) [RT #41396]
+
 4284.  [bug]           Some GeoIP options were incorrectly documented
                        using abbreviated forms which were not accepted by
                        named.  The code has been updated to allow both

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index 1ec28bffaa49a4b05e5a752f79c6561303dde0b7..27e81fab31e44f875a1ec5c6527479f635df4f8e 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -153,6 +153,12 @@
          <command>named</command> to allow access to unintended clients.
        </para>
       </listitem>
+      <listitem>
+       <para>
+         Specfic APL data could trigger a INSIST.  This flaw was discovered
+         by Brian Mitchell and is disclosed in CVE-2015-8704. [RT #41396].
+       </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="relnotes_features"><info><title>New Features</title></info>

diff --git a/lib/dns/rdata/in_1/apl_42.c b/lib/dns/rdata/in_1/apl_42.c
index bedd38ebaab87efec683fa3c8b515447baaeece7..28eb7f280b3804af4760d980c0122a8995dbe2c3 100644 (file)
--- a/lib/dns/rdata/in_1/apl_42.c
+++ b/lib/dns/rdata/in_1/apl_42.c
@@ -116,7 +116,7 @@ totext_in_apl(ARGS_TOTEXT) {
        isc_uint8_t len;
        isc_boolean_t neg;
        unsigned char buf[16];
-       char txt[sizeof(" !64000")];
+       char txt[sizeof(" !64000:")];
        const char *sep = "";
        int n;
 
@@ -140,7 +140,7 @@ totext_in_apl(ARGS_TOTEXT) {
                isc_region_consume(&sr, 1);
                INSIST(len <= sr.length);
                n = snprintf(txt, sizeof(txt), "%s%s%u:", sep,
-                            neg ? "!": "", afi);
+                            neg ? "!" : "", afi);
                INSIST(n < (int)sizeof(txt));
                RETERR(str_totext(txt, target));
                switch (afi) {