You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
74 lines
2.3 KiB
74 lines
2.3 KiB
From d4f2e0b8d8f0b5daa0d468f62a0d5f1df58ac325 Mon Sep 17 00:00:00 2001 |
|
From: Doran Moppert <dmoppert@redhat.com> |
|
Date: Tue, 26 Sep 2017 14:48:20 +0930 |
|
Subject: [PATCH 9/9] google patch hand-applied |
|
|
|
--- |
|
src/edns0.c | 10 +++++----- |
|
src/forward.c | 4 ++++ |
|
src/rfc1035.c | 6 ++++-- |
|
3 files changed, 13 insertions(+), 7 deletions(-) |
|
|
|
diff --git a/src/edns0.c b/src/edns0.c |
|
index 0552d38..bec4a36 100644 |
|
--- a/src/edns0.c |
|
+++ b/src/edns0.c |
|
@@ -212,11 +212,11 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l |
|
/* Copy back any options */ |
|
if (buff) |
|
{ |
|
- if (p + rdlen > limit) |
|
- { |
|
- free(buff); |
|
- return plen; /* Too big */ |
|
- } |
|
+ if (p + rdlen > limit) |
|
+ { |
|
+ free(buff); |
|
+ return plen; /* Too big */ |
|
+ } |
|
memcpy(p, buff, rdlen); |
|
free(buff); |
|
p += rdlen; |
|
diff --git a/src/forward.c b/src/forward.c |
|
index 0f8f462..a729c06 100644 |
|
--- a/src/forward.c |
|
+++ b/src/forward.c |
|
@@ -1412,6 +1412,10 @@ void receive_query(struct listener *listen, time_t now) |
|
udp_size = PACKETSZ; /* Sanity check - can't reduce below default. RFC 6891 6.2.3 */ |
|
} |
|
|
|
+ // Make sure the udp size is not smaller than the incoming message so that we |
|
+ // do not underflow |
|
+ if (udp_size < n) udp_size = n; |
|
+ |
|
#ifdef HAVE_AUTH |
|
if (auth_dns) |
|
{ |
|
diff --git a/src/rfc1035.c b/src/rfc1035.c |
|
index 917bac2..ae65702 100644 |
|
--- a/src/rfc1035.c |
|
+++ b/src/rfc1035.c |
|
@@ -1182,8 +1182,8 @@ int add_resource_record(struct dns_header *header, char *limit, int *truncp, int |
|
va_end(ap); /* clean up variable argument pointer */ |
|
|
|
j = p - sav - 2; |
|
- /* this has already been checked against limit before */ |
|
- PUTSHORT(j, sav); /* Now, store real RDLength */ |
|
+ /* this has already been checked against limit before */ |
|
+ PUTSHORT(j, sav); /* Now, store real RDLength */ |
|
|
|
/* check for overflow of buffer */ |
|
if (limit && ((unsigned char *)limit - p) < 0) |
|
@@ -1243,6 +1243,8 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen, |
|
int nxdomain = 0, auth = 1, trunc = 0, sec_data = 1; |
|
struct mx_srv_record *rec; |
|
size_t len; |
|
+ // Make sure we do not underflow here too. |
|
+ if (qlen > (limit - ((char *)header))) return 0; |
|
|
|
if (ntohs(header->ancount) != 0 || |
|
ntohs(header->nscount) != 0 || |
|
-- |
|
2.9.5 |
|
|
|
|