Pi-Hole/dnsmasq
1
0
Fork 0
mirror of https://github.com/pi-hole/dnsmasq.git synced 2025-12-19 10:18:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix out-of-bounds heap read in order_qsort().

Browse Source 
We only need to order two server records on the ->serial field.
Literal address records are smaller and don't have
this field and don't need to be ordered on it.
To actually provoke this bug seems to need the same server-literal
to be repeated twice, eg --address=/a/1.1.1.1 --address-/a/1.1.1.1
which is clearly rare in the wild, but if it did exist it could
provoke a SIGSEV. Thanks to Daniel Rhea for fuzzing this one.
This commit is contained in:
Simon Kelley
2024-11-21 15:28:31 +00:00
parent 0adaf13438
commit b087cf4a6c
2 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
CHANGELOG
View File

@@ -1,7 +1,15 @@
version 2.91 version 2.91
Fix spurious "resource limit exceeded messages". Thanks to Fix spurious "resource limit exceeded messages". Thanks to
Dominik Derigs for the bug report. Dominik Derigs for the bug report.
Fix out-of-bounds heap read in order_qsort().
We only need to order two server records on the ->serial field.
Literal address records are smaller and don't have
this field and don't need to be ordered on it.
To actually provoke this bug seems to need the same server-literal
to be repeated twice, eg --address=/a/1.1.1.1 --address-/a/1.1.1.1
which is clearly rare in the wild, but if it did exist it could
provoke a SIGSEV. Thanks to Daniel Rhea for fuzzing this one.
version 2.90 version 2.90
Fix reversion in --rev-server introduced in 2.88 which Fix reversion in --rev-server introduced in 2.88 which

4
src/domain-match.c
View File

@@ -541,9 +541,9 @@ static int order_qsort(const void *a, const void *b)
/* Finally, order by appearance in /etc/resolv.conf etc, for --strict-order */ /* Finally, order by appearance in /etc/resolv.conf etc, for --strict-order */
if (rc == 0) if (rc == 0)
if (!(s1->flags & SERV_LITERAL_ADDRESS)) if (!(s1->flags & SERV_IS_LOCAL) && !(s2->flags & SERV_IS_LOCAL))
rc = s1->serial - s2->serial; rc = s1->serial - s2->serial;
return rc; return rc;
} }