From: Aram Sargsyan <aram@isc.org>
Date: Sat, 20 Jun 2026 14:56:17 +0000 (+0000)
Subject: Fix PROXYv2 header size truncation bug
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=0c6186870f1dd187bbe9daa4541ab39f703341b7;p=thirdparty%2Fbind9.git

Fix PROXYv2 header size truncation bug

The 'isc_proxy2_handler_t' structure stores some size values in a
'uint16_t' type, while the maximum size can be bigger, which results
in truncation. Change the affected types to 'size_t'.
---

diff --git a/lib/isc/include/isc/proxy2.h b/lib/isc/include/isc/proxy2.h
index 175e5052ce3..61f2f41f501 100644
--- a/lib/isc/include/isc/proxy2.h
+++ b/lib/isc/include/isc/proxy2.h
@@ -293,7 +293,7 @@ struct isc_proxy2_handler {
 	int	 state;	      /*!< Current state machine state */
 	uint16_t expect_data; /*!< How much data do we need to switch to the
 				 next state */
-	uint16_t max_size; /*!< Max PROXYv2 header size including its payload */
+	size_t max_size; /*!< Max PROXYv2 header size including its payload */
 
 	isc_proxy2_handler_cb_t cb;    /*!< Data processing callback. */
 	void		       *cbarg; /*!< Callback argument. */
@@ -304,9 +304,9 @@ struct isc_proxy2_handler {
 				status value. */
 	isc_mem_t *mctx;
 
-	uint16_t header_size;	/*!< Total PROXYv2 header size (including the
-				   payload. */
-	uint16_t tlv_data_size; /*!< The size of TLVs payload size */
+	size_t header_size;   /*!< Total PROXYv2 header size (including the
+				 payload. */
+	size_t tlv_data_size; /*!< The size of TLVs payload size */
 
 	isc_proxy2_command_t	cmd; /*!< The decoded PROXYv2 command */
 	isc_proxy2_addrfamily_t proxy_addr_family; /*!< The decoded PROXYv2
@@ -322,7 +322,7 @@ struct isc_proxy2_handler {
 
 void
 isc_proxy2_handler_init(isc_proxy2_handler_t *restrict handler, isc_mem_t *mctx,
-			const uint16_t max_size, isc_proxy2_handler_cb_t cb,
+			const size_t max_size, isc_proxy2_handler_cb_t cb,
 			void *cbarg);
 /*!<
  * \brief Initialise the given 'isc_proxy2_handler_t' object, attach
@@ -338,7 +338,8 @@ isc_proxy2_handler_init(isc_proxy2_handler_t *restrict handler, isc_mem_t *mctx,
  * Requires:
  *\li	'handler' is not NULL;
  *\li	'mctx' is not NULL;
- *\li	'max_size' is >= `ISC_PROXY2_HEADER_SIZE` or is 0;
+ *\li	'max_size' is >= `ISC_PROXY2_HEADER_SIZE` &&
+ *      is <= `ISC_PROXY2_MAX_SIZE`, or is 0;
  *\li	'cb' is not NULL.
  */
 
@@ -365,7 +366,7 @@ isc_proxy2_handler_clear(isc_proxy2_handler_t *restrict handler);
  */
 
 isc_proxy2_handler_t *
-isc_proxy2_handler_new(isc_mem_t *mctx, const uint16_t max_size,
+isc_proxy2_handler_new(isc_mem_t *mctx, const size_t max_size,
 		       isc_proxy2_handler_cb_t cb, void *cbarg);
 /*!<
  * \brief Allocate and initialise a new 'isc_proxy2_handler_t'
@@ -381,7 +382,8 @@ isc_proxy2_handler_new(isc_mem_t *mctx, const uint16_t max_size,
  *
  * Requires:
  *\li	'mctx' is not NULL;
- *\li	'max_size' is >= `ISC_PROXY2_HEADER_SIZE` or is 0;
+ *\li	'max_size' is >= `ISC_PROXY2_HEADER_SIZE` &&
+ *       is <= `ISC_PROXY2_MAX_SIZE`, or is 0;
  *\li	'cb' is not NULL.
  */
 
diff --git a/lib/isc/proxy2.c b/lib/isc/proxy2.c
index 5c9644097ad..3449cb25713 100644
--- a/lib/isc/proxy2.c
+++ b/lib/isc/proxy2.c
@@ -22,7 +22,7 @@ enum isc_proxy2_states {
 
 static inline void
 isc__proxy2_handler_init_direct(isc_proxy2_handler_t *restrict handler,
-				const uint16_t max_size,
+				const size_t max_size,
 				const isc_region_t *restrict data,
 				isc_proxy2_handler_cb_t cb, void *cbarg) {
 	*handler = (isc_proxy2_handler_t){ .result = ISC_R_UNSET,
@@ -40,11 +40,12 @@ isc__proxy2_handler_init_direct(isc_proxy2_handler_t *restrict handler,
 
 void
 isc_proxy2_handler_init(isc_proxy2_handler_t *restrict handler, isc_mem_t *mctx,
-			const uint16_t max_size, isc_proxy2_handler_cb_t cb,
+			const size_t max_size, isc_proxy2_handler_cb_t cb,
 			void *cbarg) {
 	REQUIRE(handler != NULL);
 	REQUIRE(mctx != NULL);
-	REQUIRE(max_size == 0 || max_size >= ISC_PROXY2_HEADER_SIZE);
+	REQUIRE(max_size == 0 || (max_size >= ISC_PROXY2_HEADER_SIZE &&
+				  max_size <= ISC_PROXY2_MAX_SIZE));
 	REQUIRE(cb != NULL);
 
 	isc__proxy2_handler_init_direct(handler, max_size, NULL, cb, cbarg);
@@ -85,7 +86,7 @@ isc_proxy2_handler_clear(isc_proxy2_handler_t *restrict handler) {
 }
 
 isc_proxy2_handler_t *
-isc_proxy2_handler_new(isc_mem_t *mctx, const uint16_t max_size,
+isc_proxy2_handler_new(isc_mem_t *mctx, const size_t max_size,
 		       isc_proxy2_handler_cb_t cb, void *cbarg) {
 	isc_proxy2_handler_t *newhandler;
 
@@ -249,7 +250,7 @@ isc__proxy2_handler_handle_header(isc_proxy2_handler_t *restrict handler) {
 	len = isc_buffer_getuint16(&handler->hdrbuf);
 
 	if (handler->max_size > 0 &&
-	    (len + ISC_PROXY2_HEADER_SIZE) > handler->max_size)
+	    ((size_t)len + ISC_PROXY2_HEADER_SIZE) > handler->max_size)
 	{
 		goto error_range;
 	}