mailing list of musl libc
 help / color / mirror / code / Atom feed
* [musl] Erroneous rejection of pointers in __dns_parse
@ 2023-07-16  6:58 Markus Wichmann
  2023-07-17 18:48 ` Rich Felker
  0 siblings, 1 reply; 3+ messages in thread
From: Markus Wichmann @ 2023-07-16  6:58 UTC (permalink / raw)
  To: musl

Hi all,

__dns_parse() must skip over all domain names in the package as part of
its operation, and it also checks if the domain names end in a pointer,
and the pointer has an offset larger than 510, because then it also
returns failure immediately. That is probably from before the TCP merge,
when the response buffer was a fixed 512 bytes. Now it is 768, so
pointers can have an offset of up to 766. Except they cannot have an
offset larger than rlen-2 in any case.

I am not quite sure what the point of invalid pointer detection in
__dns_parse() is, given that if the name ever actually matters,
__dn_expand() will reject it in its operation. But the hardcoded limit
in __dns_parse() means that packages from TCP cannot contain pointers
that reference the last third of the buffer.

On a related note, I see that a malformed packet can send __dn_expand()
into an infinite loop: If a pointer points to another pointer, they can
form a loop. The loop can be arbitrarily complex, so history tracking
would do no good. I think it would be a good idea to reject pointers to
pointers in that function. Because then every pointer must cause at
least two bytes to be written to the destination buffer, so it would be
exhausted at some point, and that's also an abort condition.


^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2023-07-17 19:49 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-07-16  6:58 [musl] Erroneous rejection of pointers in __dns_parse Markus Wichmann
2023-07-17 18:48 ` Rich Felker
2023-07-17 19:49   ` Markus Wichmann

Code repositories for project(s) associated with this public inbox

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).