From: Seonah Moon <seonah1.moon@samsung.com>
Date: Mon, 16 Oct 2017 06:22:30 +0000 (+0900)
Subject: Fix CVE-2017-13704, which resulted in a crash on a large DNS query.
X-Git-Tag: accepted/tizen/unified/20180222.142138~2
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=refs%2Fchanges%2F09%2F170409%2F1;p=platform%2Fupstream%2Fdnsmasq.git

Fix CVE-2017-13704, which resulted in a crash on a large DNS query.

A DNS query recieved by UDP which exceeds 512 bytes (or the EDNS0 packet size,
if different.) is enough to cause SIGSEGV.

http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=63437ffbb58837b214b4b92cb1c54bc5f3279928

Change-Id: I93a69c8e308479c0abcd64eea071473419d80946
Signed-off-by: Seonah Moon <seonah1.moon@samsung.com>
---

diff --git a/src/forward.c b/src/forward.c
index 2731b90..5e6d9b8 100644
--- a/src/forward.c
+++ b/src/forward.c
@@ -1179,6 +1179,10 @@ void receive_query(struct listener *listen, time_t now)
       (msg.msg_flags & MSG_TRUNC) ||
       (header->hb3 & HB3_QR))
     return;
+
+  /* Clear buffer beyond request to avoid risk of
+     information disclosure. */
+  memset(daemon->packet + n, 0, daemon->edns_pktsz - n);
   
   source_addr.sa.sa_family = listen->family;
   
@@ -1872,6 +1876,10 @@ unsigned char *tcp_request(int confd, time_t now,
   
       if (size < (int)sizeof(struct dns_header))
 	continue;
+
+      /* Clear buffer beyond request to avoid risk of
+	 information disclosure. */
+      memset(payload + size, 0, 65536 - size);
       
       query_count++;