Limit rndc query message sizes to 32 KiB (#41073)

diff --git a/CHANGES b/CHANGES
index 7c02d40f4c76af0891251060230d6ebf1f0a5dc2..704edc92933e40542839e2fe780f04597f8a3182 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+4258.  [bug]           Limit rndc query message sizes to 32 KiB. This should
+                       not break any legitimate rndc commands, but will
+                       prevent a rogue rndc query from allocating too
+                       much memory. [RT #41073]
+
 4257.  [cleanup]       Python scripts reported incorrect version. [RT #41080]
 
 4256.  [bug]           Allow rndc command arguments to be quoted so as

diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
index 9d9075b398ee6d12d1fea039cf7017d1d93905f9..5af34b4504081c26973d3864911f74694d860385 100644 (file)
--- a/bin/named/controlconf.c
+++ b/bin/named/controlconf.c
@@ -565,6 +565,10 @@ newconnection(controllistener_t *listener, isc_socket_t *sock) {
 
        conn->sock = sock;
        isccc_ccmsg_init(listener->mctx, sock, &conn->ccmsg);
+
+       /* Set a 32 KiB upper limit on incoming message. */
+       isccc_ccmsg_setmaxsize(&conn->ccmsg, 32768);
+
        conn->ccmsg_valid = ISC_TRUE;
        conn->sending = ISC_FALSE;
        conn->buffer = NULL;