mirror of
https://github.com/isc-projects/bind9.git
synced 2026-05-22 18:17:05 -04:00
bac40394d5
The prescan and main update loops in DNS UPDATE processing both used the same counter to index the maxbytype[] quota array. The prescan loop always incremented the counter, but the main loop had 14 continue paths that skipped the increment. This allowed an authenticated DDNS client to craft an UPDATE message with padding records (e.g. CNAME+A pairs that trigger CNAME-conflict skips) to shift the counter and read wrong quota entries, bypassing per-type record limits entirely. Fix by incrementing the counter unconditionally at the start of each iteration in the main loop. |
||
|---|---|---|
| .. | ||
| include | ||
| .gitignore | ||
| client.c | ||
| hooks.c | ||
| interfacemgr.c | ||
| listenlist.c | ||
| meson.build | ||
| notify.c | ||
| probes-ns.d | ||
| query.c | ||
| server.c | ||
| stats.c | ||
| tests | ||
| update.c | ||
| xfrout.c | ||