mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-29 13:38:26 +00:00
Code Issues Releases Wiki Activity

[master] fix length check in OPENPGPKEY

Browse Source 
4170.	[security]	An incorrect boundary check in the OPENPGPKEY
			rdatatype could trigger an assertion failure.
			[RT #40286]
This commit is contained in:
Evan Hunt 2015-08-11 20:01:44 -07:00
parent b8a04d50a3
commit c707e2b986
4 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES
View File

@ -1,3 +1,7 @@
4170. [security] An incorrect boundary check in the OPENPGPKEY
rdatatype could trigger an assertion failure.
[RT #40286]
4169. [test] Added a 'wire_test -d' option to read input as 4169. [test] Added a 'wire_test -d' option to read input as
raw binary data, for use as a fuzzing harness. raw binary data, for use as a fuzzing harness.
[RT #40312] [RT #40312]

6
doc/arm/notes.xml
View File

@ -38,6 +38,12 @@
<sect2 id="relnotes_security"> <sect2 id="relnotes_security">
<title>Security Fixes</title> <title>Security Fixes</title>
<itemizedlist> <itemizedlist>
<listitem>
<para>
An incorrect boundary check in the OPENPGPKEY rdatatype
could trigger an assertion failure. [RT #40286]
</para>
</listitem>
<listitem> <listitem>
<para> <para>
A buffer accounting error could trigger an assertion failure A buffer accounting error could trigger an assertion failure

2
lib/dns/rdata.c
View File

@ -1268,7 +1268,7 @@ txt_fromwire(isc_buffer_t *source, isc_buffer_t *target) {
isc_buffer_activeregion(source, &sregion); isc_buffer_activeregion(source, &sregion);
if (sregion.length == 0) if (sregion.length == 0)
return(ISC_R_UNEXPECTEDEND); return (ISC_R_UNEXPECTEDEND);
n = *sregion.base + 1; n = *sregion.base + 1;
if (n > sregion.length) if (n > sregion.length)
return (ISC_R_UNEXPECTEDEND); return (ISC_R_UNEXPECTEDEND);

2
lib/dns/rdata/generic/openpgpkey_61.c
View File

@ -81,6 +81,8 @@ fromwire_openpgpkey(ARGS_FROMWIRE) {
* Keyring. * Keyring.
*/ */
isc_buffer_activeregion(source, &sr); isc_buffer_activeregion(source, &sr);
if (sr.length < 1)
return (ISC_R_UNEXPECTEDEND);
isc_buffer_forward(source, sr.length); isc_buffer_forward(source, sr.length);
return (mem_tobuffer(target, sr.base, sr.length)); return (mem_tobuffer(target, sr.base, sr.length));
} }