upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-11 02:39:59 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Cast the original rcode to (dns_ttl_t) when setting extended rcode

Browse source 
Shifting (signed) integer left could trigger undefined behaviour when
the shifted value would overflow into the sign bit (e.g. 2048).

The issue was found when using AFL++ and UBSAN:

    message.c:2274:33: runtime error: left shift of 2048 by 20 places cannot be represented in type 'int'
    SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior message.c:2274:33 in
This commit is contained in:
Mark Andrews 2020-08-25 22:59:35 +10:00 committed by Ondřej Surý
parent 3f85b0fe3b
commit a347641782
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
lib/dns/message.c
View file

@ -2268,10 +2268,11 @@ dns_message_renderend(dns_message_t *msg) {
dns_message_renderrelease(msg, msg->opt_reserved);
msg->opt_reserved = 0;
/*
* Set the extended rcode.
* Set the extended rcode. Cast msg->rcode to dns_ttl_t
* so that we do a unsigned shift.
*/
msg->opt->ttl &= ~DNS_MESSAGE_EDNSRCODE_MASK;
msg->opt->ttl |= ((msg->rcode << 20) &
msg->opt->ttl |= (((dns_ttl_t)(msg->rcode) << 20) &
DNS_MESSAGE_EDNSRCODE_MASK);
/*
* Render.