From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-1.1 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 19789 invoked from network); 8 May 2023 16:26:08 -0000 Received: from second.openwall.net (193.110.157.125) by inbox.vuxu.org with ESMTPUTF8; 8 May 2023 16:26:08 -0000 Received: (qmail 1326 invoked by uid 550); 8 May 2023 16:26:01 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 1294 invoked from network); 8 May 2023 16:26:01 -0000 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispras.ru 51E5840D403D DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ispras.ru; s=default; t=1683563149; bh=bgOkSah0cdTvw3vU7vDrkubTT/tWEQ0fvRFXRJhq6l4=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=T9cDoja6dAgiJu8NL416408bn57OrMAtZeEudyXWWoI1ZhFDWilRbesrePUHAfH9z vWutpkhGTJrgC0p5C3lmB6ufRfm0HVCgVR3V8/e98vphRdBvxLyksYTQ0/r650Scav bwVr+t40t6c9tkRsG6nt3pp4fCUGpTjew6CZ7B6Y= MIME-Version: 1.0 Date: Mon, 08 May 2023 19:25:49 +0300 From: Alexey Izbyshev To: musl@lists.openwall.com Cc: Alexey Kodanev In-Reply-To: <20230322131651.GW4163@brightrain.aerifal.cx> References: <20230322122916.116088-1-aleksei.kodanev@bell-sw.com> <20230322131651.GW4163@brightrain.aerifal.cx> User-Agent: Roundcube Webmail/1.4.4 Message-ID: <0c7a80b19cf470307d0cc9f2fe1b2d4e@ispras.ru> X-Sender: izbyshev@ispras.ru Content-Type: multipart/mixed; boundary="=_96578da838d8ad7e630180479ab12c86" Subject: Re: [musl] [PATCH] dns: check length field in tcp response message --=_96578da838d8ad7e630180479ab12c86 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII; format=flowed On 2023-03-22 16:16, Rich Felker wrote: > On Wed, Mar 22, 2023 at 03:29:16PM +0300, Alexey Kodanev wrote: >> The received length field in the message may be greater than the >> size of the 'answer' buffer in which the message resides. Currently, >> ABUF_SIZE is 768. And if we get a larger 'alen', it will result >> in an out-of-bounds reading during parsing, because 'alen' will >> be passed to __dns_parse() later: >> >> __dns_parse(abuf[i], alens[i], dns_parse_callback, &ctx); >> >> To fix this, limit 'alen' to the size of the received buffer. >> --- >> src/network/res_msend.c | 1 + >> 1 file changed, 1 insertion(+) >> >> diff --git a/src/network/res_msend.c b/src/network/res_msend.c >> index fef7e3a2..291853de 100644 >> --- a/src/network/res_msend.c >> +++ b/src/network/res_msend.c >> @@ -297,6 +297,7 @@ int __res_msend_rc(int nqueries, const unsigned >> char *const *queries, >> int rcode = answers[i][3] & 15; >> if (rcode != 0 && rcode != 3) >> goto out; >> + if (alen > asize) alen = asize; >> >> /* Storing the length here commits the accepted answer. >> * Immediately close TCP socket so as not to consume >> -- >> 2.25.1 > > This is incorrect. It breaks res_send, whose contract is to return the > full answer length even if it did not fit, so that the caller can > retry with the appropriate size. > > Instead, name_from_dns just needs to clamp the value before passing it > to __dns_parse. > Not only name_from_dns, but also getnameinfo. The patch is attached. Alexey --=_96578da838d8ad7e630180479ab12c86 Content-Transfer-Encoding: base64 Content-Type: text/x-diff; name=0001-getnameinfo-fix-calling-__dns_parse-with-potentially.patch Content-Disposition: attachment; filename=0001-getnameinfo-fix-calling-__dns_parse-with-potentially.patch; size=1238 RnJvbSAzMDczZDI2MzYxYmNiOWU5ZjFlOWFiOTk4NDQwYWUzYjMyMWZlODMwIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBBbGV4ZXkgSXpieXNoZXYgPGl6YnlzaGV2QGlzcHJhcy5ydT4K RGF0ZTogTW9uLCA4IE1heSAyMDIzIDE5OjAzOjQ2ICswMzAwClN1YmplY3Q6IFtQQVRDSF0gZ2V0 bmFtZWluZm86IGZpeCBjYWxsaW5nIF9fZG5zX3BhcnNlIHdpdGggcG90ZW50aWFsbHkgdG9vCiBs YXJnZSBybGVuCk1haWwtRm9sbG93dXAtVG86IG11c2xAbGlzdHMub3BlbndhbGwuY29tCgpfX3Jl c19zZW5kIHJldHVybnMgdGhlIGZ1bGwgYW5zd2VyIGxlbmd0aCBldmVuIGlmIGl0IGRpZG4ndCBm aXQgdGhlCmJ1ZmZlciwgYnV0IF9fZG5zX3BhcnNlIGV4cGVjdHMgdGhlIGxlbmd0aCBvZiB0aGUg ZmlsbGVkIHBhcnQgb2YgdGhlCmJ1ZmZlci4KClRoaXMgaXMgYW5hbG9nb3VzIHRvIGNvbW1pdCA3 NzMyN2VkMDY0YmQ1N2IwZTE4NjVjZDBlMDM2NDA1N2ZmNGE1M2I0LAp3aGljaCBmaXhlZCB0aGUg b25seSBvdGhlciBfX2Ruc19wYXJzZSBjYWxsIHNpdGUuCi0tLQogc3JjL25ldHdvcmsvZ2V0bmFt ZWluZm8uYyB8IDQgKysrLQogMSBmaWxlIGNoYW5nZWQsIDMgaW5zZXJ0aW9ucygrKSwgMSBkZWxl dGlvbigtKQoKZGlmZiAtLWdpdCBhL3NyYy9uZXR3b3JrL2dldG5hbWVpbmZvLmMgYi9zcmMvbmV0 d29yay9nZXRuYW1laW5mby5jCmluZGV4IDdhYmUwZmE5Li4xMzNjMTViMyAxMDA2NDQKLS0tIGEv c3JjL25ldHdvcmsvZ2V0bmFtZWluZm8uYworKysgYi9zcmMvbmV0d29yay9nZXRuYW1laW5mby5j CkBAIC0xNjIsOCArMTYyLDEwIEBAIGludCBnZXRuYW1laW5mbyhjb25zdCBzdHJ1Y3Qgc29ja2Fk ZHIgKnJlc3RyaWN0IHNhLCBzb2NrbGVuX3Qgc2wsCiAJCQlxdWVyeVszXSA9IDA7IC8qIGRvbid0 IG5lZWQgQUQgZmxhZyAqLwogCQkJaW50IHJsZW4gPSBfX3Jlc19zZW5kKHF1ZXJ5LCBxbGVuLCBy ZXBseSwgc2l6ZW9mIHJlcGx5KTsKIAkJCWJ1ZlswXSA9IDA7Ci0JCQlpZiAocmxlbiA+IDApCisJ CQlpZiAocmxlbiA+IDApIHsKKwkJCQlpZiAocmxlbiA+IHNpemVvZiByZXBseSkgcmxlbiA9IHNp emVvZiByZXBseTsKIAkJCQlfX2Ruc19wYXJzZShyZXBseSwgcmxlbiwgZG5zX3BhcnNlX2NhbGxi YWNrLCBidWYpOworCQkJfQogCQl9CiAJCWlmICghKmJ1ZikgewogCQkJaWYgKGZsYWdzICYgTklf TkFNRVJFUUQpIHJldHVybiBFQUlfTk9OQU1FOwotLSAKMi4zOS4yCgo= --=_96578da838d8ad7e630180479ab12c86--