1 From 5ab67e936085a9e584c9b3e43f442ef5bee7f40e Mon Sep 17 00:00:00 2001
2 From: Simon Kelley <simon@thekelleys.org.uk>
3 Date: Mon, 25 Sep 2017 20:11:58 +0100
4 Subject: [PATCH 5/9] Security fix, CVE-2017-14496, Integer underflow in
7 Fix DoS in DNS. Invalid boundary checks in the
8 add_pseudoheader function allows a memcpy call with negative
9 size An attacker which can send malicious DNS queries
10 to dnsmasq can trigger a DoS remotely.
11 dnsmasq is vulnerable only if one of the following option is
12 specified: --add-mac, --add-cpe-id or --add-subnet.
14 src/edns0.c | 13 ++++++++++++-
15 1 file changed, 12 insertions(+), 1 deletion(-)
17 diff --git a/src/edns0.c b/src/edns0.c
18 index d2b514b..eed135e 100644
21 @@ -144,7 +144,7 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
24 /* malformed option, delete the whole OPT RR and start again. */
25 - if (i + len > rdlen)
26 + if (i + 4 + len > rdlen)
30 @@ -193,6 +193,8 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
31 ntohs(header->ancount) + ntohs(header->nscount) + ntohs(header->arcount),
35 + return plen; /* Too big */
36 *p++ = 0; /* empty name */
38 PUTSHORT(udp_sz, p); /* max packet length, 512 if not given in EDNS0 header */
39 @@ -204,6 +206,11 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
40 /* Copy back any options */
43 + if (p + rdlen > limit)
46 + return plen; /* Too big */
48 memcpy(p, buff, rdlen);
51 @@ -217,8 +224,12 @@ size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *l
53 if (optno != 0 && replace != 2)
56 + return plen; /* Too big */
59 + if (p + optlen > limit)
60 + return plen; /* Too big */
61 memcpy(p, opt, optlen);
63 PUTSHORT(p - datap, lenp);