upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-20 23:00:56 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- Fix Integer Overflows in Size Calculations,

Browse source 
reported by X41 D-Sec.
This commit is contained in:
W.C.A. Wijngaards 2019-11-19 16:32:40 +01:00
parent 07156bd5ea
commit 02080f6b18
3 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
dnscrypt/dnscrypt.c
View file

@ -732,6 +732,11 @@ dnsc_load_local_data(struct dnsc_env* dnscenv, struct config_file *cfg)
); );
continue; continue;
} }
if((unsigned)strlen(dnscenv->provider_name) >= (unsigned)0xffff0000) {
/* guard against integer overflow in rrlen calculation */
verbose(VERB_OPS, "cert #%" PRIu32 " is too long", serial);
continue
}
rrlen = strlen(dnscenv->provider_name) + rrlen = strlen(dnscenv->provider_name) +
strlen(ttl_class_type) + strlen(ttl_class_type) +
4 * sizeof(struct SignedCert) + // worst case scenario 4 * sizeof(struct SignedCert) + // worst case scenario

2
doc/Changelog
View file

@ -9,6 +9,8 @@
and ipsecmod_new(), reported by X41 D-Sec. and ipsecmod_new(), reported by X41 D-Sec.
- Fix Out-of-bounds Read in rr_comment_dnskey(), - Fix Out-of-bounds Read in rr_comment_dnskey(),
reported by X41 D-Sec. reported by X41 D-Sec.
- Fix Integer Overflows in Size Calculations,
reported by X41 D-Sec.
18 November 2019: Wouter 18 November 2019: Wouter
- In unbound-host use separate variable for get_option to please - In unbound-host use separate variable for get_option to please

8
respip/respip.c
View file

@ -479,10 +479,16 @@ copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region)
if(!ck->rk.dname) if(!ck->rk.dname)
return NULL; return NULL;
if((unsigned)data->count >= 0xffff00U)
return NULL; /* guard against integer overflow in dsize */
dsize = sizeof(struct packed_rrset_data) + data->count * dsize = sizeof(struct packed_rrset_data) + data->count *
(sizeof(size_t)+sizeof(uint8_t*)+sizeof(time_t)); (sizeof(size_t)+sizeof(uint8_t*)+sizeof(time_t));
for(i=0; i<data->count; i++) for(i=0; i<data->count; i++) {
if((unsigned)dsize >= 0x0fffffffU ||
(unsigned)data->rr_len[i] >= 0x0fffffffU)
return NULL; /* guard against integer overflow */
dsize += data->rr_len[i]; dsize += data->rr_len[i];
}
d = regional_alloc(region, dsize); d = regional_alloc(region, dsize);
if(!d) if(!d)
return NULL; return NULL;