svn commit: r240732 - in stable/8/contrib/bind9: . bin/named
bin/nsupdate lib/dns lib/dns/include/dns
Doug Barton
dougb at FreeBSD.org
Thu Sep 20 04:35:21 UTC 2012
Author: dougb
Date: Thu Sep 20 04:35:20 2012
New Revision: 240732
URL: http://svn.freebsd.org/changeset/base/240732
Log:
Upgrade to 9.6-ESV-R7-P3:
Prevents a crash when queried for a record whose RDATA exceeds
65535 bytes.
Prevents a crash when validating caused by using "Bad cache" data
before it has been initialized.
ISC_QUEUE handling for recursive clients was updated to address
a race condition that could cause a memory leak. This rarely
occurred with UDP clients, but could be a significant problem
for a server handling a steady rate of TCP queries.
A condition has been corrected where improper handling of
zero-length RDATA could cause undesirable behavior, including
termination of the named process.
For more information: https://kb.isc.org/article/AA-00788
Modified:
stable/8/contrib/bind9/CHANGES
stable/8/contrib/bind9/bin/named/server.c
stable/8/contrib/bind9/bin/nsupdate/nsupdate.c
stable/8/contrib/bind9/lib/dns/include/dns/rdata.h
stable/8/contrib/bind9/lib/dns/master.c
stable/8/contrib/bind9/lib/dns/rdata.c
stable/8/contrib/bind9/lib/dns/rdataslab.c
stable/8/contrib/bind9/version
Directory Properties:
stable/8/contrib/bind9/ (props changed)
Modified: stable/8/contrib/bind9/CHANGES
==============================================================================
--- stable/8/contrib/bind9/CHANGES Thu Sep 20 04:21:29 2012 (r240731)
+++ stable/8/contrib/bind9/CHANGES Thu Sep 20 04:35:20 2012 (r240732)
@@ -1,3 +1,11 @@
+ --- 9.6-ESV-R7-P3 released ---
+
+3364. [security] Named could die on specially crafted record.
+ [RT #30416]
+
+3358 [bug] Fix declaration of fatal in bin/named/server.c
+ and bin/nsupdate/main.c. [RT #30522]
+
--- 9.6-ESV-R7-P2 released ---
3346. [security] Bad-cache data could be used before it was
Modified: stable/8/contrib/bind9/bin/named/server.c
==============================================================================
--- stable/8/contrib/bind9/bin/named/server.c Thu Sep 20 04:21:29 2012 (r240731)
+++ stable/8/contrib/bind9/bin/named/server.c Thu Sep 20 04:35:20 2012 (r240732)
@@ -228,7 +228,7 @@ static const struct {
{ NULL, ISC_FALSE }
};
-ISC_PLATFORM_NORETURN_POST static void
+ISC_PLATFORM_NORETURN_PRE static void
fatal(const char *msg, isc_result_t result) ISC_PLATFORM_NORETURN_POST;
static void
Modified: stable/8/contrib/bind9/bin/nsupdate/nsupdate.c
==============================================================================
--- stable/8/contrib/bind9/bin/nsupdate/nsupdate.c Thu Sep 20 04:21:29 2012 (r240731)
+++ stable/8/contrib/bind9/bin/nsupdate/nsupdate.c Thu Sep 20 04:35:20 2012 (r240732)
@@ -174,7 +174,7 @@ typedef struct nsu_requestinfo {
static void
sendrequest(isc_sockaddr_t *srcaddr, isc_sockaddr_t *destaddr,
dns_message_t *msg, dns_request_t **request);
-ISC_PLATFORM_NORETURN_POST static void
+ISC_PLATFORM_NORETURN_PRE static void
fatal(const char *format, ...)
ISC_FORMAT_PRINTF(1, 2) ISC_PLATFORM_NORETURN_POST;
Modified: stable/8/contrib/bind9/lib/dns/include/dns/rdata.h
==============================================================================
--- stable/8/contrib/bind9/lib/dns/include/dns/rdata.h Thu Sep 20 04:21:29 2012 (r240731)
+++ stable/8/contrib/bind9/lib/dns/include/dns/rdata.h Thu Sep 20 04:35:20 2012 (r240732)
@@ -128,6 +128,17 @@ struct dns_rdata {
#define DNS_RDATA_OFFLINE 0x0002 /*%< RRSIG has a offline key. */
/*
+ * The maximum length of a RDATA that can be sent on the wire.
+ * Max packet size (65535) less header (12), less name (1), type (2),
+ * class (2), ttl(4), length (2).
+ *
+ * None of the defined types that support name compression can exceed
+ * this and all new types are to be sent uncompressed.
+ */
+
+#define DNS_RDATA_MAXLENGTH 65512U
+
+/*
* Flags affecting rdata formatting style. Flags 0xFFFF0000
* are used by masterfile-level formatting and defined elsewhere.
* See additional comments at dns_rdata_tofmttext().
Modified: stable/8/contrib/bind9/lib/dns/master.c
==============================================================================
--- stable/8/contrib/bind9/lib/dns/master.c Thu Sep 20 04:21:29 2012 (r240731)
+++ stable/8/contrib/bind9/lib/dns/master.c Thu Sep 20 04:35:20 2012 (r240732)
@@ -75,7 +75,7 @@
/*%
* max message size - header - root - type - class - ttl - rdlen
*/
-#define MINTSIZ (65535 - 12 - 1 - 2 - 2 - 4 - 2)
+#define MINTSIZ DNS_RDATA_MAXLENGTH
/*%
* Size for tokens in the presentation format,
* The largest tokens are the base64 blocks in KEY and CERT records,
Modified: stable/8/contrib/bind9/lib/dns/rdata.c
==============================================================================
--- stable/8/contrib/bind9/lib/dns/rdata.c Thu Sep 20 04:21:29 2012 (r240731)
+++ stable/8/contrib/bind9/lib/dns/rdata.c Thu Sep 20 04:35:20 2012 (r240732)
@@ -414,6 +414,7 @@ dns_rdata_fromwire(dns_rdata_t *rdata, d
isc_buffer_t st;
isc_boolean_t use_default = ISC_FALSE;
isc_uint32_t activelength;
+ size_t length;
REQUIRE(dctx != NULL);
if (rdata != NULL) {
@@ -444,6 +445,14 @@ dns_rdata_fromwire(dns_rdata_t *rdata, d
}
/*
+ * Reject any rdata that expands out to more than DNS_RDATA_MAXLENGTH
+ * as we cannot transmit it.
+ */
+ length = isc_buffer_usedlength(target) - isc_buffer_usedlength(&st);
+ if (result == ISC_R_SUCCESS && length > DNS_RDATA_MAXLENGTH)
+ result = DNS_R_FORMERR;
+
+ /*
* We should have consumed all of our buffer.
*/
if (result == ISC_R_SUCCESS && !buffer_empty(source))
@@ -451,8 +460,7 @@ dns_rdata_fromwire(dns_rdata_t *rdata, d
if (rdata != NULL && result == ISC_R_SUCCESS) {
region.base = isc_buffer_used(&st);
- region.length = isc_buffer_usedlength(target) -
- isc_buffer_usedlength(&st);
+ region.length = length;
dns_rdata_fromregion(rdata, rdclass, type, ®ion);
}
@@ -587,6 +595,7 @@ dns_rdata_fromtext(dns_rdata_t *rdata, d
unsigned long line;
void (*callback)(dns_rdatacallbacks_t *, const char *, ...);
isc_result_t tresult;
+ size_t length;
REQUIRE(origin == NULL || dns_name_isabsolute(origin) == ISC_TRUE);
if (rdata != NULL) {
@@ -658,10 +667,13 @@ dns_rdata_fromtext(dns_rdata_t *rdata, d
}
} while (1);
+ length = isc_buffer_usedlength(target) - isc_buffer_usedlength(&st);
+ if (result == ISC_R_SUCCESS && length > DNS_RDATA_MAXLENGTH)
+ result = ISC_R_NOSPACE;
+
if (rdata != NULL && result == ISC_R_SUCCESS) {
region.base = isc_buffer_used(&st);
- region.length = isc_buffer_usedlength(target) -
- isc_buffer_usedlength(&st);
+ region.length = length;
dns_rdata_fromregion(rdata, rdclass, type, ®ion);
}
if (result != ISC_R_SUCCESS) {
@@ -789,6 +801,7 @@ dns_rdata_fromstruct(dns_rdata_t *rdata,
isc_buffer_t st;
isc_region_t region;
isc_boolean_t use_default = ISC_FALSE;
+ size_t length;
REQUIRE(source != NULL);
if (rdata != NULL) {
@@ -803,10 +816,13 @@ dns_rdata_fromstruct(dns_rdata_t *rdata,
if (use_default)
(void)NULL;
+ length = isc_buffer_usedlength(target) - isc_buffer_usedlength(&st);
+ if (result == ISC_R_SUCCESS && length > DNS_RDATA_MAXLENGTH)
+ result = ISC_R_NOSPACE;
+
if (rdata != NULL && result == ISC_R_SUCCESS) {
region.base = isc_buffer_used(&st);
- region.length = isc_buffer_usedlength(target) -
- isc_buffer_usedlength(&st);
+ region.length = length;
dns_rdata_fromregion(rdata, rdclass, type, ®ion);
}
if (result != ISC_R_SUCCESS)
Modified: stable/8/contrib/bind9/lib/dns/rdataslab.c
==============================================================================
--- stable/8/contrib/bind9/lib/dns/rdataslab.c Thu Sep 20 04:21:29 2012 (r240731)
+++ stable/8/contrib/bind9/lib/dns/rdataslab.c Thu Sep 20 04:35:20 2012 (r240732)
@@ -298,6 +298,7 @@ dns_rdataslab_fromrdataset(dns_rdataset_
length = x[i].rdata.length;
if (rdataset->type == dns_rdatatype_rrsig)
length++;
+ INSIST(length <= 0xffff);
*rawbuf++ = (length & 0xff00) >> 8;
*rawbuf++ = (length & 0x00ff);
#if DNS_RDATASET_FIXED
Modified: stable/8/contrib/bind9/version
==============================================================================
--- stable/8/contrib/bind9/version Thu Sep 20 04:21:29 2012 (r240731)
+++ stable/8/contrib/bind9/version Thu Sep 20 04:35:20 2012 (r240732)
@@ -7,4 +7,4 @@ MAJORVER=9
MINORVER=6
PATCHVER=
RELEASETYPE=-ESV
-RELEASEVER=-R7-P2
+RELEASEVER=-R7-P3
More information about the svn-src-stable-8
mailing list