diff options
| author | Seonah Moon <seonah1.moon@samsung.com> | 2017-10-16 15:22:30 +0900 |
|---|---|---|
| committer | Seonah Moon <seonah1.moon@samsung.com> | 2018-02-20 10:43:10 +0900 |
| commit | 89b9a20d6610e3bdd3ca536ee5facb2f91253bd8 (patch) | |
| tree | 6c6fa83372bc6f49becd6d110102432e1831ed43 | |
| parent | 0e108f7f3402fc35f65a1088e8f83f28b484be95 (diff) | |
| download | dnsmasq-89b9a20d6610e3bdd3ca536ee5facb2f91253bd8.tar.gz dnsmasq-89b9a20d6610e3bdd3ca536ee5facb2f91253bd8.tar.bz2 dnsmasq-89b9a20d6610e3bdd3ca536ee5facb2f91253bd8.zip | |
Fix CVE-2017-13704, which resulted in a crash on a large DNS query.
A DNS query recieved by UDP which exceeds 512 bytes (or the EDNS0 packet size,
if different.) is enough to cause SIGSEGV.
http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=63437ffbb58837b214b4b92cb1c54bc5f3279928
Change-Id: I93a69c8e308479c0abcd64eea071473419d80946
Signed-off-by: Seonah Moon <seonah1.moon@samsung.com>
| -rw-r--r-- | src/forward.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/src/forward.c b/src/forward.c index 2731b90..5e6d9b8 100644 --- a/src/forward.c +++ b/src/forward.c @@ -1179,6 +1179,10 @@ void receive_query(struct listener *listen, time_t now) (msg.msg_flags & MSG_TRUNC) || (header->hb3 & HB3_QR)) return; + + /* Clear buffer beyond request to avoid risk of + information disclosure. */ + memset(daemon->packet + n, 0, daemon->edns_pktsz - n); source_addr.sa.sa_family = listen->family; @@ -1872,6 +1876,10 @@ unsigned char *tcp_request(int confd, time_t now, if (size < (int)sizeof(struct dns_header)) continue; + + /* Clear buffer beyond request to avoid risk of + information disclosure. */ + memset(payload + size, 0, 65536 - size); query_count++; |