Module Name: src Committed By: bouyer Date: Sat Sep 15 09:09:33 UTC 2012
Modified Files: src/dist/bind [netbsd-4]: CHANGES version src/dist/bind/lib/dns [netbsd-4]: master.c rdata.c rdataslab.c src/dist/bind/lib/dns/include/dns [netbsd-4]: rdata.h Log Message: Apply patch, requested by spz in ticket #1457 dist/bind/CHANGES patch dist/bind/version patch dist/bind/lib/dns/master.c patch dist/bind/lib/dns/rdata.c patch dist/bind/lib/dns/rdataslab.c patch dist/bind/lib/dns/include/dns/rdata.h patch apply fix for CVE-2012-4244 ("Named could die on specially crafted record") from upstream. To generate a diff of this commit: cvs rdiff -u -r1.1.1.4.4.10 -r1.1.1.4.4.11 src/dist/bind/CHANGES \ src/dist/bind/version cvs rdiff -u -r1.1.1.4.4.4 -r1.1.1.4.4.5 src/dist/bind/lib/dns/master.c cvs rdiff -u -r1.1.1.3.4.3 -r1.1.1.3.4.4 src/dist/bind/lib/dns/rdata.c cvs rdiff -u -r1.1.1.3.4.4 -r1.1.1.3.4.5 src/dist/bind/lib/dns/rdataslab.c cvs rdiff -u -r1.1.1.3.4.2 -r1.1.1.3.4.3 \ src/dist/bind/lib/dns/include/dns/rdata.h Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/dist/bind/CHANGES diff -u src/dist/bind/CHANGES:1.1.1.4.4.10 src/dist/bind/CHANGES:1.1.1.4.4.11 --- src/dist/bind/CHANGES:1.1.1.4.4.10 Tue Jul 24 20:38:38 2012 +++ src/dist/bind/CHANGES Sat Sep 15 09:09:31 2012 @@ -1,3 +1,8 @@ + --- 9.4-ESV-R4-P2nb2: added patches from 9.7.6-P3 --- + +3364. [security] Named could die on specially crafted record. + [RT #30416] + --- 9.4-ESV-R4-P2nb1: added patches from 9.6-ESV-R7-P2 --- 3346. [security] Bad-cache data could be used before it was Index: src/dist/bind/version diff -u src/dist/bind/version:1.1.1.4.4.10 src/dist/bind/version:1.1.1.4.4.11 --- src/dist/bind/version:1.1.1.4.4.10 Tue Jul 24 20:38:38 2012 +++ src/dist/bind/version Sat Sep 15 09:09:31 2012 @@ -1,4 +1,4 @@ -# $Id: version,v 1.1.1.4.4.10 2012/07/24 20:38:38 riz Exp $ +# $Id: version,v 1.1.1.4.4.11 2012/09/15 09:09:31 bouyer Exp $ # # This file must follow /bin/sh rules. It is imported directly via # configure. @@ -7,4 +7,4 @@ MAJORVER=9 MINORVER=4 PATCHVER= RELEASETYPE=-ESV -RELEASEVER=-R4-P2nb1 +RELEASEVER=-R4-P2nb2 Index: src/dist/bind/lib/dns/master.c diff -u src/dist/bind/lib/dns/master.c:1.1.1.4.4.4 src/dist/bind/lib/dns/master.c:1.1.1.4.4.5 --- src/dist/bind/lib/dns/master.c:1.1.1.4.4.4 Sun Nov 20 13:02:27 2011 +++ src/dist/bind/lib/dns/master.c Sat Sep 15 09:09:32 2012 @@ -1,4 +1,4 @@ -/* $NetBSD: master.c,v 1.1.1.4.4.4 2011/11/20 13:02:27 bouyer Exp $ */ +/* $NetBSD: master.c,v 1.1.1.4.4.5 2012/09/15 09:09:32 bouyer Exp $ */ /* * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC") @@ -77,7 +77,7 @@ /*% * max message size - header - root - type - class - ttl - rdlen */ -#define MINTSIZ (65535 - 12 - 1 - 2 - 2 - 4 - 2) +#define MINTSIZ DNS_RDATA_MAXLENGTH /*% * Size for tokens in the presentation format, * The largest tokens are the base64 blocks in KEY and CERT records, Index: src/dist/bind/lib/dns/rdata.c diff -u src/dist/bind/lib/dns/rdata.c:1.1.1.3.4.3 src/dist/bind/lib/dns/rdata.c:1.1.1.3.4.4 --- src/dist/bind/lib/dns/rdata.c:1.1.1.3.4.3 Tue Jun 5 20:01:02 2012 +++ src/dist/bind/lib/dns/rdata.c Sat Sep 15 09:09:32 2012 @@ -1,4 +1,4 @@ -/* $NetBSD: rdata.c,v 1.1.1.3.4.3 2012/06/05 20:01:02 bouyer Exp $ */ +/* $NetBSD: rdata.c,v 1.1.1.3.4.4 2012/09/15 09:09:32 bouyer Exp $ */ /* * Copyright (C) 2004-2006, 2008 Internet Systems Consortium, Inc. ("ISC") @@ -407,6 +407,7 @@ dns_rdata_fromwire(dns_rdata_t *rdata, d isc_buffer_t st; isc_boolean_t use_default = ISC_FALSE; isc_uint32_t activelength; + size_t length; REQUIRE(dctx != NULL); if (rdata != NULL) { @@ -437,6 +438,14 @@ dns_rdata_fromwire(dns_rdata_t *rdata, d } /* + * Reject any rdata that expands out to more than DNS_RDATA_MAXLENGTH + * as we cannot transmit it. + */ + length = isc_buffer_usedlength(target) - isc_buffer_usedlength(&st); + if (result == ISC_R_SUCCESS && length > DNS_RDATA_MAXLENGTH) + result = DNS_R_FORMERR; + + /* * We should have consumed all of our buffer. */ if (result == ISC_R_SUCCESS && !buffer_empty(source)) @@ -444,8 +453,7 @@ dns_rdata_fromwire(dns_rdata_t *rdata, d if (rdata != NULL && result == ISC_R_SUCCESS) { region.base = isc_buffer_used(&st); - region.length = isc_buffer_usedlength(target) - - isc_buffer_usedlength(&st); + region.length = length; dns_rdata_fromregion(rdata, rdclass, type, ®ion); } @@ -580,6 +588,7 @@ dns_rdata_fromtext(dns_rdata_t *rdata, d unsigned long line; void (*callback)(dns_rdatacallbacks_t *, const char *, ...); isc_result_t tresult; + size_t length; REQUIRE(origin == NULL || dns_name_isabsolute(origin) == ISC_TRUE); if (rdata != NULL) { @@ -652,10 +661,13 @@ dns_rdata_fromtext(dns_rdata_t *rdata, d } } while (1); + length = isc_buffer_usedlength(target) - isc_buffer_usedlength(&st); + if (result == ISC_R_SUCCESS && length > DNS_RDATA_MAXLENGTH) + result = ISC_R_NOSPACE; + if (rdata != NULL && result == ISC_R_SUCCESS) { region.base = isc_buffer_used(&st); - region.length = isc_buffer_usedlength(target) - - isc_buffer_usedlength(&st); + region.length = length; dns_rdata_fromregion(rdata, rdclass, type, ®ion); } if (result != ISC_R_SUCCESS) { @@ -762,6 +774,7 @@ dns_rdata_fromstruct(dns_rdata_t *rdata, isc_buffer_t st; isc_region_t region; isc_boolean_t use_default = ISC_FALSE; + size_t length; REQUIRE(source != NULL); if (rdata != NULL) { @@ -776,10 +789,13 @@ dns_rdata_fromstruct(dns_rdata_t *rdata, if (use_default) (void)NULL; + length = isc_buffer_usedlength(target) - isc_buffer_usedlength(&st); + if (result == ISC_R_SUCCESS && length > DNS_RDATA_MAXLENGTH) + result = ISC_R_NOSPACE; + if (rdata != NULL && result == ISC_R_SUCCESS) { region.base = isc_buffer_used(&st); - region.length = isc_buffer_usedlength(target) - - isc_buffer_usedlength(&st); + region.length = length; dns_rdata_fromregion(rdata, rdclass, type, ®ion); } if (result != ISC_R_SUCCESS) Index: src/dist/bind/lib/dns/rdataslab.c diff -u src/dist/bind/lib/dns/rdataslab.c:1.1.1.3.4.4 src/dist/bind/lib/dns/rdataslab.c:1.1.1.3.4.5 --- src/dist/bind/lib/dns/rdataslab.c:1.1.1.3.4.4 Tue Jun 5 20:01:03 2012 +++ src/dist/bind/lib/dns/rdataslab.c Sat Sep 15 09:09:33 2012 @@ -1,4 +1,4 @@ -/* $NetBSD: rdataslab.c,v 1.1.1.3.4.4 2012/06/05 20:01:03 bouyer Exp $ */ +/* $NetBSD: rdataslab.c,v 1.1.1.3.4.5 2012/09/15 09:09:33 bouyer Exp $ */ /* * Copyright (C) 2004-2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC") @@ -287,6 +287,7 @@ dns_rdataslab_fromrdataset(dns_rdataset_ #if DNS_RDATASET_FIXED offsettable[x[i].order] = rawbuf - offsetbase; #endif + INSIST(x[i].rdata.length <= 0xffff); *rawbuf++ = (x[i].rdata.length & 0xff00) >> 8; *rawbuf++ = (x[i].rdata.length & 0x00ff); #if DNS_RDATASET_FIXED Index: src/dist/bind/lib/dns/include/dns/rdata.h diff -u src/dist/bind/lib/dns/include/dns/rdata.h:1.1.1.3.4.2 src/dist/bind/lib/dns/include/dns/rdata.h:1.1.1.3.4.3 --- src/dist/bind/lib/dns/include/dns/rdata.h:1.1.1.3.4.2 Sun Jan 23 21:47:41 2011 +++ src/dist/bind/lib/dns/include/dns/rdata.h Sat Sep 15 09:09:33 2012 @@ -1,4 +1,4 @@ -/* $NetBSD: rdata.h,v 1.1.1.3.4.2 2011/01/23 21:47:41 bouyer Exp $ */ +/* $NetBSD: rdata.h,v 1.1.1.3.4.3 2012/09/15 09:09:33 bouyer Exp $ */ /* * Copyright (C) 2004, 2005, 2008, 2009 Internet Systems Consortium, Inc. ("ISC") @@ -129,6 +129,18 @@ struct dns_rdata { #define DNS_RDATA_UPDATE 0x0001 /*%< update pseudo record */ /* + * The maximum length of a RDATA that can be sent on the wire. + * Max packet size (65535) less header (12), less name (1), type (2), + * class (2), ttl(4), length (2). + * + * None of the defined types that support name compression can exceed + * this and all new types are to be sent uncompressed. + */ + +#define DNS_RDATA_MAXLENGTH 65512U + + +/* * Flags affecting rdata formatting style. Flags 0xFFFF0000 * are used by masterfile-level formatting and defined elsewhere. * See additional comments at dns_rdata_tofmttext().