Fix problem with arbitrary RR caching.

Caching an answer which has more that one RR, with at least
one answer being <=13 bytes and at least one being >13 bytes
can screw up the F_KEYTAG flag bit, resulting in the wrong
type of the address union being used and either a bad value
return or a crash in the block code.

Thanks to Dominik Derigs and the Pi-hole project for finding
and characterising this.
This commit is contained in:
Simon Kelley
2023-09-02 21:34:54 +01:00
parent 9bbf098a97
commit 3b5ddf37d9

View File

@@ -812,6 +812,7 @@ int extract_addresses(struct dns_header *header, size_t qlen, char *name, time_t
{ {
addr.rrdata.rrtype = aqtype; addr.rrdata.rrtype = aqtype;
addr.rrdata.datalen = (char)ardlen; addr.rrdata.datalen = (char)ardlen;
flags &= ~F_KEYTAG; /* in case of >1 answer, not all the same. */
if (ardlen != 0) if (ardlen != 0)
memcpy(addr.rrdata.data, p1, ardlen); memcpy(addr.rrdata.data, p1, ardlen);
} }