diff options
Diffstat (limited to 'meta/recipes-connectivity/bind/bind/CVE-2016-2776.patch')
-rw-r--r-- | meta/recipes-connectivity/bind/bind/CVE-2016-2776.patch | 123 |
1 files changed, 0 insertions, 123 deletions
diff --git a/meta/recipes-connectivity/bind/bind/CVE-2016-2776.patch b/meta/recipes-connectivity/bind/bind/CVE-2016-2776.patch deleted file mode 100644 index 738bf60058..0000000000 --- a/meta/recipes-connectivity/bind/bind/CVE-2016-2776.patch +++ /dev/null | |||
@@ -1,123 +0,0 @@ | |||
1 | From 1171111657081970585f9f0e03b476358c33a6c0 Mon Sep 17 00:00:00 2001 | ||
2 | From: Mark Andrews <marka@isc.org> | ||
3 | Date: Wed, 12 Oct 2016 20:36:52 +0900 | ||
4 | Subject: [PATCH] | ||
5 | 4467. [security] It was possible to trigger an assertion when | ||
6 | rendering a message. (CVE-2016-2776) [RT #43139] | ||
7 | |||
8 | Backport commit 2bd0922cf995b9ac205fc83baf7e220b95c6bf12 from the | ||
9 | v9.11.0_patch branch. | ||
10 | |||
11 | CVE: CVE-2016-2776 | ||
12 | Upstream-Status: Backport | ||
13 | |||
14 | Signed-off-by: zhengruoqin <zhengrq.fnst@cn.fujitsu.com> | ||
15 | |||
16 | --- | ||
17 | CHANGES | 3 +++ | ||
18 | lib/dns/message.c | 42 +++++++++++++++++++++++++++++++----------- | ||
19 | 2 files changed, 34 insertions(+), 11 deletions(-) | ||
20 | |||
21 | diff --git a/CHANGES b/CHANGES | ||
22 | index d0a9d12..5c8c61a 100644 | ||
23 | --- a/CHANGES | ||
24 | +++ b/CHANGES | ||
25 | @@ -1,3 +1,6 @@ | ||
26 | +4467. [security] It was possible to trigger an assertion when | ||
27 | + rendering a message. (CVE-2016-2776) [RT #43139] | ||
28 | + | ||
29 | 4406. [security] getrrsetbyname with a non absolute name could | ||
30 | trigger an infinite recursion bug in lwresd | ||
31 | and named with lwres configured if when combined | ||
32 | diff --git a/lib/dns/message.c b/lib/dns/message.c | ||
33 | index 6b5b4bb..b74dc81 100644 | ||
34 | --- a/lib/dns/message.c | ||
35 | +++ b/lib/dns/message.c | ||
36 | @@ -1754,7 +1754,7 @@ dns_message_renderbegin(dns_message_t *msg, dns_compress_t *cctx, | ||
37 | if (r.length < DNS_MESSAGE_HEADERLEN) | ||
38 | return (ISC_R_NOSPACE); | ||
39 | |||
40 | - if (r.length < msg->reserved) | ||
41 | + if (r.length - DNS_MESSAGE_HEADERLEN < msg->reserved) | ||
42 | return (ISC_R_NOSPACE); | ||
43 | |||
44 | /* | ||
45 | @@ -1895,8 +1895,29 @@ norender_rdataset(const dns_rdataset_t *rdataset, unsigned int options, | ||
46 | |||
47 | return (ISC_TRUE); | ||
48 | } | ||
49 | - | ||
50 | #endif | ||
51 | + | ||
52 | +static isc_result_t | ||
53 | +renderset(dns_rdataset_t *rdataset, dns_name_t *owner_name, | ||
54 | + dns_compress_t *cctx, isc_buffer_t *target, | ||
55 | + unsigned int reserved, unsigned int options, unsigned int *countp) | ||
56 | +{ | ||
57 | + isc_result_t result; | ||
58 | + | ||
59 | + /* | ||
60 | + * Shrink the space in the buffer by the reserved amount. | ||
61 | + */ | ||
62 | + if (target->length - target->used < reserved) | ||
63 | + return (ISC_R_NOSPACE); | ||
64 | + | ||
65 | + target->length -= reserved; | ||
66 | + result = dns_rdataset_towire(rdataset, owner_name, | ||
67 | + cctx, target, options, countp); | ||
68 | + target->length += reserved; | ||
69 | + | ||
70 | + return (result); | ||
71 | +} | ||
72 | + | ||
73 | isc_result_t | ||
74 | dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid, | ||
75 | unsigned int options) | ||
76 | @@ -1939,6 +1960,8 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid, | ||
77 | /* | ||
78 | * Shrink the space in the buffer by the reserved amount. | ||
79 | */ | ||
80 | + if (msg->buffer->length - msg->buffer->used < msg->reserved) | ||
81 | + return (ISC_R_NOSPACE); | ||
82 | msg->buffer->length -= msg->reserved; | ||
83 | |||
84 | total = 0; | ||
85 | @@ -2214,9 +2237,8 @@ dns_message_renderend(dns_message_t *msg) { | ||
86 | * Render. | ||
87 | */ | ||
88 | count = 0; | ||
89 | - result = dns_rdataset_towire(msg->opt, dns_rootname, | ||
90 | - msg->cctx, msg->buffer, 0, | ||
91 | - &count); | ||
92 | + result = renderset(msg->opt, dns_rootname, msg->cctx, | ||
93 | + msg->buffer, msg->reserved, 0, &count); | ||
94 | msg->counts[DNS_SECTION_ADDITIONAL] += count; | ||
95 | if (result != ISC_R_SUCCESS) | ||
96 | return (result); | ||
97 | @@ -2232,9 +2254,8 @@ dns_message_renderend(dns_message_t *msg) { | ||
98 | if (result != ISC_R_SUCCESS) | ||
99 | return (result); | ||
100 | count = 0; | ||
101 | - result = dns_rdataset_towire(msg->tsig, msg->tsigname, | ||
102 | - msg->cctx, msg->buffer, 0, | ||
103 | - &count); | ||
104 | + result = renderset(msg->tsig, msg->tsigname, msg->cctx, | ||
105 | + msg->buffer, msg->reserved, 0, &count); | ||
106 | msg->counts[DNS_SECTION_ADDITIONAL] += count; | ||
107 | if (result != ISC_R_SUCCESS) | ||
108 | return (result); | ||
109 | @@ -2255,9 +2276,8 @@ dns_message_renderend(dns_message_t *msg) { | ||
110 | * the owner name of a SIG(0) is irrelevant, and will not | ||
111 | * be set in a message being rendered. | ||
112 | */ | ||
113 | - result = dns_rdataset_towire(msg->sig0, dns_rootname, | ||
114 | - msg->cctx, msg->buffer, 0, | ||
115 | - &count); | ||
116 | + result = renderset(msg->sig0, dns_rootname, msg->cctx, | ||
117 | + msg->buffer, msg->reserved, 0, &count); | ||
118 | msg->counts[DNS_SECTION_ADDITIONAL] += count; | ||
119 | if (result != ISC_R_SUCCESS) | ||
120 | return (result); | ||
121 | -- | ||
122 | 2.7.4 | ||
123 | |||