mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-30 22:15:20 +00:00
Code Issues Releases Wiki Activity

fixed an exploitable hang bug

Browse Source 
3383.	[security]	A certain combinations of records in the RBT could
                        cause named to hang while populating the additional
                        section of a response. [RT #31090]
This commit is contained in:
Evan Hunt
2012-09-26 17:09:43 -07:00
parent da35568c71
commit c872f39a00
2 changed files with 36 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES
View File

@@ -1,3 +1,7 @@
3383. [security] A certain combinations of records in the RBT could
cause named to hang while populating the additional
section of a response. [RT #31090]
3382. [bug] SOA query from slave used use-v6-udp-ports range,
if set, regardless of the address family in use.
[RT #24173]

64
bin/named/query.c
View File

@@ -1125,13 +1125,6 @@ query_isduplicate(ns_client_t *client, dns_name_t *name,
mname = NULL;
}
/*
* If the dns_name_t we're looking up is already in the message,
* we don't want to trigger the caller's name replacement logic.
*/
if (name == mname)
mname = NULL;
if (mnamep != NULL)
*mnamep = mname;
@@ -1364,6 +1357,7 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
if (dns_rdataset_isassociated(rdataset) &&
!query_isduplicate(client, fname, type, &mname)) {
if (mname != NULL) {
INSIST(mname != fname);
query_releasename(client, &fname);
fname = mname;
} else
@@ -1433,11 +1427,13 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
#endif
if (!query_isduplicate(client, fname,
dns_rdatatype_a, &mname)) {
if (mname != NULL) {
query_releasename(client, &fname);
fname = mname;
} else
need_addname = ISC_TRUE;
if (mname != fname) {
if (mname != NULL) {
query_releasename(client, &fname);
fname = mname;
} else
need_addname = ISC_TRUE;
}
ISC_LIST_APPEND(fname->list, rdataset, link);
added_something = ISC_TRUE;
if (sigrdataset != NULL &&
@@ -1490,11 +1486,13 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
#endif
if (!query_isduplicate(client, fname,
dns_rdatatype_aaaa, &mname)) {
if (mname != NULL) {
query_releasename(client, &fname);
fname = mname;
} else
need_addname = ISC_TRUE;
if (mname != fname) {
if (mname != NULL) {
query_releasename(client, &fname);
fname = mname;
} else
need_addname = ISC_TRUE;
}
ISC_LIST_APPEND(fname->list, rdataset, link);
added_something = ISC_TRUE;
if (sigrdataset != NULL &&
@@ -2025,22 +2023,24 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
crdataset->type == dns_rdatatype_aaaa) {
if (!query_isduplicate(client, fname, crdataset->type,
&mname)) {
if (mname != NULL) {
/*
* A different type of this name is
* already stored in the additional
* section. We'll reuse the name.
* Note that this should happen at most
* once. Otherwise, fname->link could
* leak below.
*/
INSIST(mname0 == NULL);
if (mname != fname) {
if (mname != NULL) {
/*
* A different type of this name is
* already stored in the additional
* section. We'll reuse the name.
* Note that this should happen at most
* once. Otherwise, fname->link could
* leak below.
*/
INSIST(mname0 == NULL);
query_releasename(client, &fname);
fname = mname;
mname0 = mname;
} else
need_addname = ISC_TRUE;
query_releasename(client, &fname);
fname = mname;
mname0 = mname;
} else
need_addname = ISC_TRUE;
}
ISC_LIST_UNLINK(cfname.list, crdataset, link);
ISC_LIST_APPEND(fname->list, crdataset, link);
added_something = ISC_TRUE;