Changeset 20c82e3 in mainline

Timestamp:

2017-09-04T15:49:07Z (7 years ago)

Author:

Jiri Svoboda <jiri@…>

Branches:

lfn, master, serial, ticket/834-toolchain-update, topic/msim-upgrade, topic/simplify-dev-export

Children:

42f61f01

Parents:

1ddbf81

Message:

Fix DNS resolver bugs: Possible write via stale pointer, bad decoding pointer-compressed name, bad decoding of multiple-pointer-compressed name.

File:

• uspace/srv/net/dnsrsrv/dns_msg.c (modified) (13 diffs)

uspace/srv/net/dnsrsrv/dns_msg.c

@@ -77 +77 @@
                 return ENOMEM;
 
-        str_cpy((*dstr) + s1, nsize - s1, suff);
+        str_cpy(nstr + s1, nsize - s1, suff);
 
         *dstr = nstr;
@@ -195 +195 @@
                         break;
 
-                if (!first) {
-                        rc = dns_dstr_ext(&name, ".");
-                        if (rc != EOK) {
-                                rc = ENOMEM;
-                                goto error;
-                        }
-                }
-
                 if ((lsize & 0xc0) == 0xc0) {
                         /* Pointer */
@@ -233 +225 @@
                          * the message continues
                          */
-                        *eoff = eptr;
+                        if (*eoff == 0)
+                                *eoff = eptr;
 
                         bp = pdu->data + ptr;
@@ -243 +236 @@
                         rc = EINVAL;
                         goto error;
+                }
+
+                if (!first) {
+                        rc = dns_dstr_ext(&name, ".");
+                        if (rc != EOK) {
+                                rc = ENOMEM;
+                                goto error;
+                        }
                 }
 
@@ -413 +414 @@
         rc = dns_name_decode(pdu, boff, &rr->name, &name_eoff);
         if (rc != EOK) {
-                log_msg(LOG_DEFAULT, LVL_DEBUG, "Error decoding name");
+                log_msg(LOG_DEFAULT, LVL_DEBUG, "dns_rr_decode: error decoding name");
                 free(rr);
                 return ENOMEM;
@@ -421 +422 @@
                 free(rr->name);
                 free(rr);
+                log_msg(LOG_DEFAULT, LVL_DEBUG, "dns_rr_decode: error name_off");
                 return EINVAL;
         }
@@ -430 +432 @@
                 free(rr->name);
                 free(rr);
+                log_msg(LOG_DEFAULT, LVL_DEBUG, "dns_rr_decode: error bsz");
                 return EINVAL;
         }
@@ -445 +448 @@
         bsz -= sizeof(uint32_t);
 
+        log_msg(LOG_DEFAULT, LVL_DEBUG2, "dns_rr_decode: rtype=0x%x, rclass=0x%x, ttl=0x%x",
+            rr->rtype, rr->rclass, rr->ttl );
+
         rdlength = dns_uint16_t_decode(bp, bsz);
         bp += sizeof(uint16_t);
@@ -452 +458 @@
                 free(rr->name);
                 free(rr);
+                log_msg(LOG_DEFAULT, LVL_DEBUG, "dns_rr_decode: Error rdlength %zu > bsz %zu", rdlength, bsz);
                 return EINVAL;
         }
 
         rr->rdata_size = rdlength;
-        rr->rdata = calloc(1, sizeof(rdlength));
+        log_msg(LOG_DEFAULT, LVL_DEBUG2, "dns_rr_decode: rdlength=%zu", rdlength);
+        rr->rdata = calloc(1, rdlength);
         if (rr->rdata == NULL) {
                 free(rr->name);
                 free(rr);
+                log_msg(LOG_DEFAULT, LVL_DEBUG, "dns_rr_decode: Error memory");
                 return ENOMEM;
         }
@@ -470 +479 @@
         *eoff = bp - pdu->data;
         *retrr = rr;
+        log_msg(LOG_DEFAULT, LVL_DEBUG2, "dns_rr_decode: done");
         return EOK;
 }
@@ -586 +596 @@
         memcpy(msg->pdu.data, data, size);
         msg->pdu.size = size;
-        log_msg(LOG_DEFAULT, LVL_NOTE, "dns_message_decode: pdu->data = %p, "
+        log_msg(LOG_DEFAULT, LVL_DEBUG2, "dns_message_decode: pdu->data = %p, "
             "pdu->size=%zu", msg->pdu.data, msg->pdu.size);
 
@@ -605 +615 @@
 
         qd_count = uint16_t_be2host(hdr->qd_count);
+        log_msg(LOG_DEFAULT, LVL_DEBUG2, "qd_count=%zu", qd_count);
+
 
         for (i = 0; i < qd_count; i++) {
@@ -618 +630 @@
 
         an_count = uint16_t_be2host(hdr->an_count);
+        log_msg(LOG_DEFAULT, LVL_DEBUG2, "an_count=%zu", an_count);
 
         for (i = 0; i < an_count; i++) {