mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 06:25:31 +00:00
Code Issues Releases Wiki Activity

Cast the original rcode to (dns_ttl_t) when setting extended rcode

Browse Source 
Shifting (signed) integer left could trigger undefined behaviour when
the shifted value would overflow into the sign bit (e.g. 2048).

The issue was found when using AFL++ and UBSAN:

    message.c:2274:33: runtime error: left shift of 2048 by 20 places cannot be represented in type 'int'
    SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior message.c:2274:33 in
This commit is contained in:
Mark Andrews
2020-08-25 22:59:35 +10:00
committed by Ondřej Surý
parent 3f85b0fe3b
commit a347641782
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
lib/dns/message.c
View File

@@ -2268,10 +2268,11 @@ dns_message_renderend(dns_message_t *msg) {
dns_message_renderrelease(msg, msg->opt_reserved);
msg->opt_reserved = 0;
/*
* Set the extended rcode.
* Set the extended rcode. Cast msg->rcode to dns_ttl_t
* so that we do a unsigned shift.
*/
msg->opt->ttl &= ~DNS_MESSAGE_EDNSRCODE_MASK;
msg->opt->ttl |= ((msg->rcode << 20) &
msg->opt->ttl |= (((dns_ttl_t)(msg->rcode) << 20) &
DNS_MESSAGE_EDNSRCODE_MASK);
/*
* Render.