dns: validate reverse dns query name lengths

Validate reverse dns query names length to be able to be valid names:

For IPv6 records there is a fixed name length of 72 (32 nibbles + 31
dots + ".ip6.arpa".

For Ipv4 it's a bit more complicated since the decimal numbers have
variable lenghts, so we need to check a range.

Reject any names that do not fit within those bounds. This also ensures
that the name fits into name_buf{,6}.

Fixes: TOB-OWRT-1
Fixes: 2b28094 ("dns: add support for reverse address mapping queries")
Reported-by: Trail of Bits
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>

2 files changed, 14 insertions, 0 deletions

diff --git a/dns.c b/dns.c
index e2db851..37d2692 100644
--- a/dns.c
+++ b/dns.c
@@ -599,6 +599,10 @@ parse_question(struct interface *iface, struct sockaddr *from, char *name, struc
 
 	case TYPE_PTR:
 		if (is_reverse_dns_query(name, ".in-addr.arpa")) {
+			if (strlen(name) < MIN_PTR_NAME_LEN ||
+			    strlen(name) > MAX_PTR_NAME_LEN)
+				break;
+
 			host = strstr(name, ".in-addr.arpa");
 			char name_buf[256];
 			strcpy(name_buf, name);
@@ -608,6 +612,9 @@ parse_question(struct interface *iface, struct sockaddr *from, char *name, struc
 		}
 
 		if (is_reverse_dns_query(name, ".ip6.arpa")) {
+			if (strlen(name) != MAX_PTR6_NAME_LEN)
+				break;
+
 			host6 = strstr(name, ".ip6.arpa");
 			char name_buf6[256];
 			strcpy(name_buf6, name);
diff --git a/dns.h b/dns.h
index fde049f..ed0907d 100644
--- a/dns.h
+++ b/dns.h
@@ -40,6 +40,13 @@
 #define MAX_NAME_LEN		8096
 #define MAX_DATA_LEN		8096
 
+/* 4.3.2.1.in-addr.arpa */
+#define MIN_PTR_NAME_LEN	20
+/* 123.123.123.123.in-addr.arpa */
+#define MAX_PTR_NAME_LEN	28
+/* .e.d.c.b.a.9.8.7.6.5.4.3.2.1.0.f.e.d.c.b.a.9.8.7.6.5.4.3.2.1.0.ip6.arpa */
+#define MAX_PTR6_NAME_LEN	72
+
 #define C_DNS_SD		"_services._dns-sd._udp.local"
 
 struct dns_header {