shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-02 10:51:20 +03:00
Code

resolve: fix redirection loops in compressed RR

Browse Source 
Loops in RR compression were only detected for the first entry.
Multiple redirections should be allowed, each one checking for an
infinite loop on its own starting point.
Also update the pointer on each redirection to avoid longer loops of
labels and redirections, in names like:
(start) [len=1] "A", [ptr to start]

(David: rename variable to "jump_barrier" and add reference to RFC)
This commit is contained in:
Stanisław Pitucha 2014-11-18 16:25:20 +11:00 committed by David Herrmann
parent c21b92ffe7
commit c75dbf9bea
Notes: Lennart Poettering 2014-12-09 20:12:38 +01:00 
Backport: security
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/resolve/resolved-dns-packet.c
View File

@ -860,7 +860,7 @@ fail:
int dns_packet_read_name(DnsPacket *p, char **_ret,
bool allow_compression, size_t *start) {
size_t saved_rindex, after_rindex = 0;
size_t saved_rindex, after_rindex = 0, jump_barrier;
_cleanup_free_ char *ret = NULL;
size_t n = 0, allocated = 0;
bool first = true;
@ -870,6 +870,7 @@ int dns_packet_read_name(DnsPacket *p, char **_ret,
assert(_ret);
saved_rindex = p->rindex;
jump_barrier = p->rindex;
for (;;) {
uint8_t c, d;
@ -916,7 +917,7 @@ int dns_packet_read_name(DnsPacket *p, char **_ret,
goto fail;
ptr = (uint16_t) (c & ~0xc0) << 8 | (uint16_t) d;
if (ptr < DNS_PACKET_HEADER_SIZE || ptr >= saved_rindex) {
if (ptr < DNS_PACKET_HEADER_SIZE || ptr >= jump_barrier) {
r = -EBADMSG;
goto fail;
}
@ -924,6 +925,8 @@ int dns_packet_read_name(DnsPacket *p, char **_ret,
if (after_rindex == 0)
after_rindex = p->rindex;
/* Jumps are limited to a "prior occurence" (RFC-1035 4.1.4) */
jump_barrier = ptr;
p->rindex = ptr;
} else
goto fail;