mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 22:45:39 +00:00
Code Issues Releases Wiki Activity

fixed an exploitable hang bug

Browse Source 
3383.	[security]	A certain combinations of records in the RBT could
                        cause named to hang while populating the additional
                        section of a response. [RT #31090]
This commit is contained in:
Evan Hunt
2012-09-26 17:09:43 -07:00
parent da35568c71
commit c872f39a00
2 changed files with 36 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES
View File

@@ -1,3 +1,7 @@
3383. [security] A certain combinations of records in the RBT could
cause named to hang while populating the additional
section of a response. [RT #31090]
3382. [bug] SOA query from slave used use-v6-udp-ports range, 3382. [bug] SOA query from slave used use-v6-udp-ports range,
if set, regardless of the address family in use. if set, regardless of the address family in use.
[RT #24173] [RT #24173]

64
bin/named/query.c
View File

@@ -1125,13 +1125,6 @@ query_isduplicate(ns_client_t *client, dns_name_t *name,
mname = NULL; mname = NULL;
} }
/*
* If the dns_name_t we're looking up is already in the message,
* we don't want to trigger the caller's name replacement logic.
*/
if (name == mname)
mname = NULL;
if (mnamep != NULL) if (mnamep != NULL)
*mnamep = mname; *mnamep = mname;
@@ -1364,6 +1357,7 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
if (dns_rdataset_isassociated(rdataset) && if (dns_rdataset_isassociated(rdataset) &&
!query_isduplicate(client, fname, type, &mname)) { !query_isduplicate(client, fname, type, &mname)) {
if (mname != NULL) { if (mname != NULL) {
INSIST(mname != fname);
query_releasename(client, &fname); query_releasename(client, &fname);
fname = mname; fname = mname;
} else } else
@@ -1433,11 +1427,13 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
#endif #endif
if (!query_isduplicate(client, fname, if (!query_isduplicate(client, fname,
dns_rdatatype_a, &mname)) { dns_rdatatype_a, &mname)) {
if (mname != NULL) { if (mname != fname) {
query_releasename(client, &fname); if (mname != NULL) {
fname = mname; query_releasename(client, &fname);
} else fname = mname;
need_addname = ISC_TRUE; } else
need_addname = ISC_TRUE;
}
ISC_LIST_APPEND(fname->list, rdataset, link); ISC_LIST_APPEND(fname->list, rdataset, link);
added_something = ISC_TRUE; added_something = ISC_TRUE;
if (sigrdataset != NULL && if (sigrdataset != NULL &&
@@ -1490,11 +1486,13 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
#endif #endif
if (!query_isduplicate(client, fname, if (!query_isduplicate(client, fname,
dns_rdatatype_aaaa, &mname)) { dns_rdatatype_aaaa, &mname)) {
if (mname != NULL) { if (mname != fname) {
query_releasename(client, &fname); if (mname != NULL) {
fname = mname; query_releasename(client, &fname);
} else fname = mname;
need_addname = ISC_TRUE; } else
need_addname = ISC_TRUE;
}
ISC_LIST_APPEND(fname->list, rdataset, link); ISC_LIST_APPEND(fname->list, rdataset, link);
added_something = ISC_TRUE; added_something = ISC_TRUE;
if (sigrdataset != NULL && if (sigrdataset != NULL &&
@@ -2025,22 +2023,24 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
crdataset->type == dns_rdatatype_aaaa) { crdataset->type == dns_rdatatype_aaaa) {
if (!query_isduplicate(client, fname, crdataset->type, if (!query_isduplicate(client, fname, crdataset->type,
&mname)) { &mname)) {
if (mname != NULL) { if (mname != fname) {
/* if (mname != NULL) {
* A different type of this name is /*
* already stored in the additional * A different type of this name is
* section. We'll reuse the name. * already stored in the additional
* Note that this should happen at most * section. We'll reuse the name.
* once. Otherwise, fname->link could * Note that this should happen at most
* leak below. * once. Otherwise, fname->link could
*/ * leak below.
INSIST(mname0 == NULL); */
INSIST(mname0 == NULL);
query_releasename(client, &fname); query_releasename(client, &fname);
fname = mname; fname = mname;
mname0 = mname; mname0 = mname;
} else } else
need_addname = ISC_TRUE; need_addname = ISC_TRUE;
}
ISC_LIST_UNLINK(cfname.list, crdataset, link); ISC_LIST_UNLINK(cfname.list, crdataset, link);
ISC_LIST_APPEND(fname->list, crdataset, link); ISC_LIST_APPEND(fname->list, crdataset, link);
added_something = ISC_TRUE; added_something = ISC_TRUE;