dnsmasq: forward.c: fix CVE-2017-13704
authorKevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
Thu, 31 Aug 2017 11:57:02 +0000 (13:57 +0200)
committerZoltan HERPAI <wigyori@uid0.hu>
Thu, 31 Aug 2017 11:57:02 +0000 (13:57 +0200)
commit00bf56d61aa50a49144b014e3b285e476b4785dc
tree92c36aa3f0fa2dc86796b2f809bbab7041158506
parent13e575c53c4df8a6da29ebe80d1829d05b59cf5c
dnsmasq: forward.c: fix CVE-2017-13704

Fix SIGSEGV in rfc1035.c answer_request() line 1228 where memset()
is called with header & limit pointing at the same address and thus
tries to clear memory from before the buffer begins.

answer_request() is called with an invalid edns packet size provided by
the client.  Ensure the udp_size provided by the client is bounded by
512 and configured maximum as per RFC 6891 6.2.3 "Values lower than 512
MUST be treated as equal to 512"

The client that exposed the problem provided a payload udp size of 0.

Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
Acked-by: Hans Dedecker <dedeckeh@gmail.com>
package/network/services/dnsmasq/patches/025-fix-CVE-2017-13704.patch [new file with mode: 0644]