summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch')
-rw-r--r--meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch141
1 files changed, 141 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch b/meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch
new file mode 100644
index 0000000..638ac23
--- /dev/null
+++ b/meta/recipes-connectivity/bind/bind/CVE-2016-1285.patch
@@ -0,0 +1,141 @@
1From 31e4657cf246e41d4c5c890315cb6cf89a0db25a Mon Sep 17 00:00:00 2001
2From: Mark Andrews <marka@isc.org>
3Date: Thu, 18 Feb 2016 12:11:27 +1100
4Subject: [PATCH] 4318. [security] Malformed control messages can
5trigger assertions in named and rndc. (CVE-2016-1285) [RT #41666]
6
7(cherry picked from commit a2b15b3305acd52179e6f3dc7d073b07fbc40b8e)
8
9CVE: CVE-2016-1285
10Upstream-Status: Backport
11
12[Skipped CHANGES and doc/arm/notes.xml changes.]
13
14Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
15---
16 CHANGES | 3 +++
17 bin/named/control.c | 2 +-
18 bin/named/controlconf.c | 2 +-
19 bin/rndc/rndc.c | 8 ++++----
20 doc/arm/notes.xml | 8 ++++++++
21 lib/isccc/cc.c | 14 +++++++-------
22 6 files changed, 24 insertions(+), 13 deletions(-)
23
24diff --git a/bin/named/control.c b/bin/named/control.c
25index 01fbe35..b1b744f 100644
26--- a/bin/named/control.c
27+++ b/bin/named/control.c
28@@ -89,7 +89,7 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {
29 #endif
30
31 data = isccc_alist_lookup(message, "_data");
32- if (data == NULL) {
33+ if (!isccc_alist_alistp(data)) {
34 /*
35 * No data section.
36 */
37diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
38index 95feaf5..31bdc48 100644
39--- a/bin/named/controlconf.c
40+++ b/bin/named/controlconf.c
41@@ -397,7 +397,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
42 * Limit exposure to replay attacks.
43 */
44 _ctrl = isccc_alist_lookup(request, "_ctrl");
45- if (_ctrl == NULL) {
46+ if (!isccc_alist_alistp(_ctrl)) {
47 log_invalid(&conn->ccmsg, ISC_R_FAILURE);
48 goto cleanup_request;
49 }
50diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
51index c7d8fe1..ba3ac3a 100644
52--- a/bin/rndc/rndc.c
53+++ b/bin/rndc/rndc.c
54@@ -249,8 +249,8 @@ rndc_recvdone(isc_task_t *task, isc_event_t *event) {
55 DO("parse message", isccc_cc_fromwire(&source, &response, &secret));
56
57 data = isccc_alist_lookup(response, "_data");
58- if (data == NULL)
59- fatal("no data section in response");
60+ if (!isccc_alist_alistp(data))
61+ fatal("bad or missing data section in response");
62 result = isccc_cc_lookupstring(data, "err", &errormsg);
63 if (result == ISC_R_SUCCESS) {
64 failed = ISC_TRUE;
65@@ -313,8 +313,8 @@ rndc_recvnonce(isc_task_t *task, isc_event_t *event) {
66 DO("parse message", isccc_cc_fromwire(&source, &response, &secret));
67
68 _ctrl = isccc_alist_lookup(response, "_ctrl");
69- if (_ctrl == NULL)
70- fatal("_ctrl section missing");
71+ if (!isccc_alist_alistp(_ctrl))
72+ fatal("bad or missing ctrl section in response");
73 nonce = 0;
74 if (isccc_cc_lookupuint32(_ctrl, "_nonce", &nonce) != ISC_R_SUCCESS)
75 nonce = 0;
76
77diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c
78index 9915568..ffcd584 100644
79--- a/lib/isccc/cc.c
80+++ b/lib/isccc/cc.c
81@@ -284,10 +284,10 @@ verify(isccc_sexpr_t *alist, unsigned char *data, unsigned int length,
82 * Extract digest.
83 */
84 _auth = isccc_alist_lookup(alist, "_auth");
85- if (_auth == NULL)
86+ if (!isccc_alist_alistp(_auth))
87 return (ISC_R_FAILURE);
88 hmd5 = isccc_alist_lookup(_auth, "hmd5");
89- if (hmd5 == NULL)
90+ if (!isccc_sexpr_binaryp(hmac))
91 return (ISC_R_FAILURE);
92 /*
93 * Compute digest.
94@@ -540,7 +540,7 @@ isccc_cc_createack(isccc_sexpr_t *message, isc_boolean_t ok,
95 REQUIRE(ackp != NULL && *ackp == NULL);
96
97 _ctrl = isccc_alist_lookup(message, "_ctrl");
98- if (_ctrl == NULL ||
99+ if (!isccc_alist_alistp(_ctrl) ||
100 isccc_cc_lookupuint32(_ctrl, "_ser", &serial) != ISC_R_SUCCESS ||
101 isccc_cc_lookupuint32(_ctrl, "_tim", &t) != ISC_R_SUCCESS)
102 return (ISC_R_FAILURE);
103@@ -584,7 +584,7 @@ isccc_cc_isack(isccc_sexpr_t *message) {
104 isccc_sexpr_t *_ctrl;
105
106 _ctrl = isccc_alist_lookup(message, "_ctrl");
107- if (_ctrl == NULL)
108+ if (!isccc_alist_alistp(_ctrl))
109 return (ISC_FALSE);
110 if (isccc_cc_lookupstring(_ctrl, "_ack", NULL) == ISC_R_SUCCESS)
111 return (ISC_TRUE);
112@@ -596,7 +596,7 @@ isccc_cc_isreply(isccc_sexpr_t *message) {
113 isccc_sexpr_t *_ctrl;
114
115 _ctrl = isccc_alist_lookup(message, "_ctrl");
116- if (_ctrl == NULL)
117+ if (!isccc_alist_alistp(_ctrl))
118 return (ISC_FALSE);
119 if (isccc_cc_lookupstring(_ctrl, "_rpl", NULL) == ISC_R_SUCCESS)
120 return (ISC_TRUE);
121@@ -616,7 +616,7 @@ isccc_cc_createresponse(isccc_sexpr_t *message, isccc_time_t now,
122
123 _ctrl = isccc_alist_lookup(message, "_ctrl");
124 _data = isccc_alist_lookup(message, "_data");
125- if (_ctrl == NULL || _data == NULL ||
126+ if (!isccc_alist_alistp(_ctrl) || !isccc_alist_alistp(_data) ||
127 isccc_cc_lookupuint32(_ctrl, "_ser", &serial) != ISC_R_SUCCESS ||
128 isccc_cc_lookupstring(_data, "type", &type) != ISC_R_SUCCESS)
129 return (ISC_R_FAILURE);
130@@ -797,7 +797,7 @@ isccc_cc_checkdup(isccc_symtab_t *symtab, isccc_sexpr_t *message,
131 isccc_sexpr_t *_ctrl;
132
133 _ctrl = isccc_alist_lookup(message, "_ctrl");
134- if (_ctrl == NULL ||
135+ if (!isccc_alist_alistp(_ctrl) ||
136 isccc_cc_lookupstring(_ctrl, "_ser", &_ser) != ISC_R_SUCCESS ||
137 isccc_cc_lookupstring(_ctrl, "_tim", &_tim) != ISC_R_SUCCESS)
138 return (ISC_R_FAILURE);
139--
1401.9.1
141