Fix a stack buffer overflow in the statistics channel

A long timestamp in an If-Modified-Since header could overflow a
fixed-size buffer.

diff --git a/bin/tests/system/statschannel/tests.sh b/bin/tests/system/statschannel/tests.sh
index d2ca2e0d2c83481e20a5f3a63fb51cbd2eace8e8..980bdf7579444ac9f4b20f03ca31d68a3af68d81 100644 (file)
--- a/bin/tests/system/statschannel/tests.sh
+++ b/bin/tests/system/statschannel/tests.sh
@@ -74,8 +74,23 @@ loadkeys_on() {
 
 status=0
 n=1
+
+echo_i "Prepare for if-modified-since test ($n)"
 ret=0
+i=0
+if $FEATURETEST --have-libxml2 && [ -x "${CURL}" ] ; then
+    URL="http://10.53.0.3:${EXTRAPORT1}/bind9.xsl"
+    ${CURL} --silent --show-error --fail --output bind9.xsl.1 $URL
+    ret=$?
+else
+    echo_i "skipping test: requires libxml2 and curl"
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
 echo_i "checking consistency between named.stats and xml/json ($n)"
+ret=0
 rm -f ns2/named.stats
 $DIGCMD +tcp example ns > dig.out.$n || ret=1
 $RNDCCMD 10.53.0.2 stats 2>&1 | sed 's/^/I:ns1 /'
@@ -563,5 +578,27 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 n=$((n + 1))
 
+echo_i "Check if-modified-since works ($n)"
+ret=0
+if $FEATURETEST --have-libxml2 && [ -x "${CURL}" ] ; then
+    URL="http://10.53.0.3:${EXTRAPORT1}/bind9.xsl"
+    # ensure over-long time stamps are ignored
+    ${CURL} --silent --show-error --fail --output bind9.xsl.2 $URL \
+           --header 'If-Modified-Since: 0123456789 0123456789 0123456789 0123456789 0123456789 0123456789'
+    if  ! [ bind9.xsl.2 -nt bind9.xsl.1 ] ||
+        ! ${CURL} --silent --show-error --fail \
+                 --output bind9.xsl.3 $URL \
+                 --time-cond bind9.xsl.1 ||
+       [ -f bind9.xsl.3 ]
+    then
+          ret=1
+    fi
+else
+    echo_i "skipping test: requires libxml2 and curl"
+fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+n=$((n + 1))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

diff --git a/lib/isc/httpd.c b/lib/isc/httpd.c
index 7790bcfe509c3f8cf4f8341eee243824d3ff1041..c73d7d161acad8c55ab8f6cea56702823e1853e3 100644 (file)
--- a/lib/isc/httpd.c
+++ b/lib/isc/httpd.c
@@ -451,7 +451,9 @@ process_request(isc_httpd_t *httpd, size_t last_len) {
                        if (value_match(header, "deflate")) {
                                httpd->flags |= ACCEPT_DEFLATE;
                        }
-               } else if (name_match(header, "If-Modified-Since")) {
+               } else if (name_match(header, "If-Modified-Since") &&
+                          header->value_len < ISC_FORMATHTTPTIMESTAMP_SIZE)
+               {
                        char timestamp[ISC_FORMATHTTPTIMESTAMP_SIZE + 1];
                        memmove(timestamp, header->value, header->value_len);
                        timestamp[header->value_len] = 0;