package/network/services/dnsmasq/patches/025-backport-fix-CVE-2017-13704.patch

   1 From 63437ffbb58837b214b4b92cb1c54bc5f3279928 Mon Sep 17 00:00:00 2001
   2 From: Simon Kelley <simon@thekelleys.org.uk>
   3 Date: Wed, 6 Sep 2017 22:34:21 +0100
   4 Subject: [PATCH] Fix CVE-2017-13704, which resulted in a crash on a large DNS
   5  query.
   6
   7 A DNS query recieved by UDP which exceeds 512 bytes (or the EDNS0 packet size,
   8 if different.) is enough to cause SIGSEGV.
   9 ---
  10  CHANGELOG     |    7 +++++++
  11  src/auth.c    |    5 -----
  12  src/forward.c |    8 ++++++++
  13  src/rfc1035.c |    5 -----
  14  4 files changed, 15 insertions(+), 10 deletions(-)
  15
  16 diff --git a/CHANGELOG b/CHANGELOG
  17 index 3a640f3..7e65912 100644
  18 --- a/CHANGELOG
  19 +++ b/CHANGELOG
  20 @@ -17,6 +17,13 @@ version 2.78
  21         --strict-order active. Thanks to Hans Dedecker
  22         for the patch
  23
  24 +       Fix regression in 2.77, ironically added as a security
  25 +       improvement, which resulted in a crash when a DNS
  26 +       query exceeded 512 bytes (or the EDNS0 packet size,
  27 +       if different.) Thanks to Christian Kujau, Arne Woerner
  28 +       Juan Manuel Fernandez and Kevin Darbyshire-Bryant for
  29 +       chasing this one down.  CVE-2017-13704 applies.
  30 +
  31
  32  version 2.77
  33         Generate an error when configured with a CNAME loop,
  34 diff --git a/src/auth.c b/src/auth.c
  35 index 2c24e16..7f95f98 100644
  36 --- a/src/auth.c
  37 +++ b/src/auth.c
  38 @@ -119,11 +119,6 @@ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t n
  39    struct cname *a, *candidate;
  40    unsigned int wclen;
  41
  42 -  /* Clear buffer beyond request to avoid risk of
  43 -     information disclosure. */
  44 -  memset(((char *)header) + qlen, 0,
  45 -        (limit - ((char *)header)) - qlen);
  46 -
  47    if (ntohs(header->qdcount) == 0 || OPCODE(header) != QUERY )
  48      return 0;
  49
  50 diff --git a/src/forward.c b/src/forward.c
  51 index f22556a..e3fa94b 100644
  52 --- a/src/forward.c
  53 +++ b/src/forward.c
  54 @@ -1188,6 +1188,10 @@ void receive_query(struct listener *listen, time_t now)
  55        (msg.msg_flags & MSG_TRUNC) ||
  56        (header->hb3 & HB3_QR))
  57      return;
  58 +
  59 +  /* Clear buffer beyond request to avoid risk of
  60 +     information disclosure. */
  61 +  memset(daemon->packet + n, 0, daemon->edns_pktsz - n);
  62
  63    source_addr.sa.sa_family = listen->family;
  64
  65 @@ -1688,6 +1692,10 @@ unsigned char *tcp_request(int confd, time_t now,
  66
  67        if (size < (int)sizeof(struct dns_header))
  68         continue;
  69 +
  70 +      /* Clear buffer beyond request to avoid risk of
  71 +        information disclosure. */
  72 +      memset(payload + size, 0, 65536 - size);
  73
  74        query_count++;
  75
  76 diff --git a/src/rfc1035.c b/src/rfc1035.c
  77 index 26f5301..af2fe46 100644
  78 --- a/src/rfc1035.c
  79 +++ b/src/rfc1035.c
  80 @@ -1223,11 +1223,6 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
  81    struct mx_srv_record *rec;
  82    size_t len;
  83
  84 -  /* Clear buffer beyond request to avoid risk of
  85 -     information disclosure. */
  86 -  memset(((char *)header) + qlen, 0,
  87 -        (limit - ((char *)header)) - qlen);
  88 -
  89    if (ntohs(header->ancount) != 0 ||
  90        ntohs(header->nscount) != 0 ||
  91        ntohs(header->qdcount) == 0 ||
  92 --
  93 1.7.10.4
  94