4582. [security] 'rndc ""' could trigger a assertion failure in named.

                        (CVE-2017-3138) [RT #44924]

(cherry picked from commit 8e8dfc5941e2375f2f8dadf3706258dd0db5f2e6)

diff --git a/CHANGES b/CHANGES
index 3ab216a8bc4afaaeee8e1e456fc7228d99738d1b..814a6b78a06e51f0159b3bd02ce7f9c4c177171e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,8 @@
        --- 9.11.0-P5 released ---
 
+4582.  [security]      'rndc ""' could trigger a assertion failure in named.
+                       (CVE-2017-3138) [RT #44924]
+
 4580.  [bug]           4578 introduced a regression when handling CNAME to
                        referral below the current domain. [RT #44850]
 

diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
index 8ccf7d226404c9bb8560ca70650cdb53c84ff0df..36c4e052f99a8998ea0963baa77fcdb4cc37033e 100644 (file)
--- a/bin/tests/system/rndc/tests.sh
+++ b/bin/tests/system/rndc/tests.sh
@@ -557,5 +557,13 @@ EOF
     status=`expr $status + $ret`
 fi
 
+n=`expr $n + 1`
+echo "I:check 'rndc \"\"' is handled ($n)"
+ret=0
+$RNDCCMD "" > rndc.out.test$n 2>&1 && ret=1
+grep "rndc: '' failed: failure" rndc.out.test$n > /dev/null
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1

diff --git a/lib/isc/include/isc/lex.h b/lib/isc/include/isc/lex.h
index bc4b653d1a568aa220378257ea342b0e6d8e960c..f78bdb20d8cc52e2f8861ad3850b658bd7f4b0d6 100644 (file)
--- a/lib/isc/include/isc/lex.h
+++ b/lib/isc/include/isc/lex.h
@@ -145,8 +145,6 @@ isc_lex_create(isc_mem_t *mctx, size_t max_token, isc_lex_t **lexp);
  * Requires:
  *\li  '*lexp' is a valid lexer.
  *
- *\li  max_token > 0.
- *
  * Ensures:
  *\li  On success, *lexp is attached to the newly created lexer.
  *

diff --git a/lib/isc/lex.c b/lib/isc/lex.c
index 0f8ca532e313d87c86db5b83224cb44433d4bd86..bf7c0dde775a36ba2bf1a25a6b67045a9e0b9e27 100644 (file)
--- a/lib/isc/lex.c
+++ b/lib/isc/lex.c
@@ -86,9 +86,10 @@ isc_lex_create(isc_mem_t *mctx, size_t max_token, isc_lex_t **lexp) {
        /*
         * Create a lexer.
         */
-
        REQUIRE(lexp != NULL && *lexp == NULL);
-       REQUIRE(max_token > 0U);
+
+       if (max_token == 0U)
+               max_token = 1;
 
        lex = isc_mem_get(mctx, sizeof(*lex));
        if (lex == NULL)