From 9dafee4d154c8d0f68275af2542b52d04228e4bf Mon Sep 17 00:00:00 2001 From: "taesub.kim" Date: Tue, 22 Dec 2015 10:06:54 +0900 Subject: Modified license using SPDX license identifier Change-Id: I295f6c8928965973ccf3dfb173d1d0b43a2edc5f Signed-off-by: Taesub Kim --- LICENSE | 10 ++++++++++ LICENSE.mit | 21 +++++++++++++++++++++ packaging/c-ares.spec | 5 +++-- 3 files changed, 34 insertions(+), 2 deletions(-) create mode 100644 LICENSE create mode 100644 LICENSE.mit diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..e3f5b64 --- /dev/null +++ b/LICENSE @@ -0,0 +1,10 @@ +Copyright 1998 by the Massachusetts Institute of Technology. + +Permission to use, copy, modify, and distribute this software and its +documentation for any purpose and without fee is hereby granted, provided that +the above copyright notice appear in all copies and that both that copyright +notice and this permission notice appear in supporting documentation, and that +the name of M.I.T. not be used in advertising or publicity pertaining to +distribution of the software without specific, written prior permission. +M.I.T. makes no representations about the suitability of this software for any +purpose. It is provided "as is" without express or implied warranty. diff --git a/LICENSE.mit b/LICENSE.mit new file mode 100644 index 0000000..c6e52bc --- /dev/null +++ b/LICENSE.mit @@ -0,0 +1,21 @@ +COPYRIGHT AND PERMISSION NOTICE + +Copyright (c) + +All rights reserved. + +Permission to use, copy, modify, and distribute this software for any purpose +with or without fee is hereby granted, provided that the above copyright +notice and this permission notice appear in all copies. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN +NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, +DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR +OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE +OR OTHER DEALINGS IN THE SOFTWARE. + +Except as contained in this notice, the name of a copyright holder shall not +be used in advertising or otherwise to promote the sale, use or other dealings +in this Software without prior written authorization of the copyright holder. diff --git a/packaging/c-ares.spec b/packaging/c-ares.spec index f48f88b..a44ce71 100644 --- a/packaging/c-ares.spec +++ b/packaging/c-ares.spec @@ -48,6 +48,8 @@ make %{?_smp_mflags} %install %make_install +mkdir -p %{buildroot}/usr/share/license +cp LICENSE %{buildroot}/usr/share/license/%{name} %post -p /sbin/ldconfig -n libcares @@ -65,5 +67,4 @@ make %{?_smp_mflags} %{_includedir}/*.h %{_mandir}/man3/ares_* %{_libdir}/pkgconfig/libcares.pc - -%changelog +/usr/share/license/%{name} -- cgit v1.2.3 From ca8ee1372d34c7dbb67aad0219530625ec2f7483 Mon Sep 17 00:00:00 2001 From: hyunuktak Date: Mon, 31 Oct 2016 13:35:37 +0900 Subject: CVE-2016-5180 ares_create_query single byte out of buffer write Change-Id: I42baed5e1354095b27eab3fa90dc7433f6ba8362 Signed-off-by: hyunuktak --- ares_create_query.c | 84 +++++++++++++++++++++++++---------------------------- 1 file changed, 39 insertions(+), 45 deletions(-) mode change 100644 => 100755 ares_create_query.c diff --git a/ares_create_query.c b/ares_create_query.c old mode 100644 new mode 100755 index 8624e2f..b9204e6 --- a/ares_create_query.c +++ b/ares_create_query.c @@ -85,57 +85,31 @@ */ int ares_create_query(const char *name, int dnsclass, int type, - unsigned short id, int rd, unsigned char **buf, - int *buflen, int max_udp_size) + unsigned short id, int rd, unsigned char **bufp, + int *buflenp, int max_udp_size) { - int len; + size_t len; unsigned char *q; const char *p; + size_t buflen; + unsigned char *buf; /* Set our results early, in case we bail out early with an error. */ - *buflen = 0; - *buf = NULL; + *buflenp = 0; + *bufp = NULL; - /* Compute the length of the encoded name so we can check buflen. - * Start counting at 1 for the zero-length label at the end. */ - len = 1; - for (p = name; *p; p++) - { - if (*p == '\\' && *(p + 1) != 0) - p++; - len++; - } - /* If there are n periods in the name, there are n + 1 labels, and - * thus n + 1 length fields, unless the name is empty or ends with a - * period. So add 1 unless name is empty or ends with a period. - */ - if (*name && *(p - 1) != '.') - len++; - - /* Immediately reject names that are longer than the maximum of 255 - * bytes that's specified in RFC 1035 ("To simplify implementations, - * the total length of a domain name (i.e., label octets and label - * length octets) is restricted to 255 octets or less."). We aren't - * doing this just to be a stickler about RFCs. For names that are - * too long, 'dnscache' closes its TCP connection to us immediately - * (when using TCP) and ignores the request when using UDP, and - * BIND's named returns ServFail (TCP or UDP). Sending a request - * that we know will cause 'dnscache' to close the TCP connection is - * painful, since that makes any other outstanding requests on that - * connection fail. And sending a UDP request that we know - * 'dnscache' will ignore is bad because resources will be tied up - * until we time-out the request. + /* Allocate a memory area for the maximum size this packet might need. +2 + * is for the length byte and zero termination if no dots or ecscaping is + * used. */ - if (len > MAXCDNAME) - return ARES_EBADNAME; - - *buflen = len + HFIXEDSZ + QFIXEDSZ + (max_udp_size ? EDNSFIXEDSZ : 0); - *buf = malloc(*buflen); - if (!*buf) - return ARES_ENOMEM; + len = strlen(name) + 2 + HFIXEDSZ + QFIXEDSZ + + (max_udp_size ? EDNSFIXEDSZ : 0); + buf = ares_malloc(len); + if (!buf) + return ARES_ENOMEM; /* Set up the header. */ - q = *buf; + q = buf; memset(q, 0, HFIXEDSZ); DNS_HEADER_SET_QID(q, id); DNS_HEADER_SET_OPCODE(q, QUERY); @@ -159,8 +133,10 @@ int ares_create_query(const char *name, int dnsclass, int type, q += HFIXEDSZ; while (*name) { - if (*name == '.') + if (*name == '.') { + free(buf); return ARES_EBADNAME; + } /* Count the number of bytes in this label. */ len = 0; @@ -170,8 +146,10 @@ int ares_create_query(const char *name, int dnsclass, int type, p++; len++; } - if (len > MAXLABEL) + if (len > MAXLABEL) { + free(buf); return ARES_EBADNAME; + } /* Encode the length and copy the data. */ *q++ = (unsigned char)len; @@ -195,14 +173,30 @@ int ares_create_query(const char *name, int dnsclass, int type, DNS_QUESTION_SET_TYPE(q, type); DNS_QUESTION_SET_CLASS(q, dnsclass); + q += QFIXEDSZ; if (max_udp_size) { - q += QFIXEDSZ; memset(q, 0, EDNSFIXEDSZ); q++; DNS_RR_SET_TYPE(q, T_OPT); DNS_RR_SET_CLASS(q, max_udp_size); + q += (EDNSFIXEDSZ-1); + } + buflen = (q - buf); + + /* Reject names that are longer than the maximum of 255 bytes that's + * specified in RFC 1035 ("To simplify implementations, the total length of + * a domain name (i.e., label octets and label length octets) is restricted + * to 255 octets or less."). */ + if (buflen > (MAXCDNAME + HFIXEDSZ + QFIXEDSZ + + (max_udp_size ? EDNSFIXEDSZ : 0))) { + free (buf); + return ARES_EBADNAME; } + /* we know this fits in an int at this point */ + *buflenp = (int) buflen; + *bufp = buf; + return ARES_SUCCESS; } -- cgit v1.2.3