mailing list of musl libc
 help / color / mirror / code / Atom feed
From: Markus Wichmann <>
Subject: [musl] Erroneous rejection of pointers in __dns_parse
Date: Sun, 16 Jul 2023 08:58:04 +0200	[thread overview]
Message-ID: <ZLOU/LQyEwWo3FlZ@voyager> (raw)

Hi all,

__dns_parse() must skip over all domain names in the package as part of
its operation, and it also checks if the domain names end in a pointer,
and the pointer has an offset larger than 510, because then it also
returns failure immediately. That is probably from before the TCP merge,
when the response buffer was a fixed 512 bytes. Now it is 768, so
pointers can have an offset of up to 766. Except they cannot have an
offset larger than rlen-2 in any case.

I am not quite sure what the point of invalid pointer detection in
__dns_parse() is, given that if the name ever actually matters,
__dn_expand() will reject it in its operation. But the hardcoded limit
in __dns_parse() means that packages from TCP cannot contain pointers
that reference the last third of the buffer.

On a related note, I see that a malformed packet can send __dn_expand()
into an infinite loop: If a pointer points to another pointer, they can
form a loop. The loop can be arbitrarily complex, so history tracking
would do no good. I think it would be a good idea to reject pointers to
pointers in that function. Because then every pointer must cause at
least two bytes to be written to the destination buffer, so it would be
exhausted at some point, and that's also an abort condition.


             reply	other threads:[~2023-07-16  6:58 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-07-16  6:58 Markus Wichmann [this message]
2023-07-17 18:48 ` Rich Felker
2023-07-17 19:49   ` Markus Wichmann

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=ZLOU/LQyEwWo3FlZ@voyager \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).