From 89b9a20d6610e3bdd3ca536ee5facb2f91253bd8 Mon Sep 17 00:00:00 2001 From: Seonah Moon Date: Mon, 16 Oct 2017 15:22:30 +0900 Subject: [PATCH] Fix CVE-2017-13704, which resulted in a crash on a large DNS query. A DNS query recieved by UDP which exceeds 512 bytes (or the EDNS0 packet size, if different.) is enough to cause SIGSEGV. http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=63437ffbb58837b214b4b92cb1c54bc5f3279928 Change-Id: I93a69c8e308479c0abcd64eea071473419d80946 Signed-off-by: Seonah Moon --- src/forward.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/forward.c b/src/forward.c index 2731b90..5e6d9b8 100644 --- a/src/forward.c +++ b/src/forward.c @@ -1179,6 +1179,10 @@ void receive_query(struct listener *listen, time_t now) (msg.msg_flags & MSG_TRUNC) || (header->hb3 & HB3_QR)) return; + + /* Clear buffer beyond request to avoid risk of + information disclosure. */ + memset(daemon->packet + n, 0, daemon->edns_pktsz - n); source_addr.sa.sa_family = listen->family; @@ -1872,6 +1876,10 @@ unsigned char *tcp_request(int confd, time_t now, if (size < (int)sizeof(struct dns_header)) continue; + + /* Clear buffer beyond request to avoid risk of + information disclosure. */ + memset(payload + size, 0, 65536 - size); query_count++; -- 2.7.4