diff options
| author | Elliott Hughes <enh@google.com> | 2016-11-14 13:56:32 -0800 |
|---|---|---|
| committer | gitbuildkicker <android-build@google.com> | 2016-12-19 16:16:45 -0800 |
| commit | d8f3abd3713d7d1cb327193d84e5305b3b43f8f9 (patch) | |
| tree | 149c859bef74e30495dcad2caa6f214fece751c0 | |
| parent | cf8398cbe56504ef331b026d15e2d5228dd8d8c3 (diff) | |
| download | bionic-nougat-mr1.4-release.tar.gz | |
Check for bad packets in getaddrinfo.c's getanswer.android-7.1.1_r27android-7.1.1_r16nougat-mr1.4-release
The near duplicate in gethnamaddr.c was already doing so (this fix
is basically copy and pasted from there, but with both copies modified
to avoid skirting undefined behavior).
Bug: http://b/32322088
Test: browser still works
Change-Id: Ied6662be567fb1bddc7ceb138cae1da77fb57976
(cherry picked from commit 27a4459d945e34fabd7166791a5b862ccea83f23)
(cherry picked from commit 418fe1eb1aeefc2268a40c5cec0ceb62672fa026)
| -rw-r--r-- | libc/dns/net/getaddrinfo.c | 18 | ||||
| -rw-r--r-- | libc/dns/net/gethnamaddr.c | 5 |
2 files changed, 18 insertions, 5 deletions
diff --git a/libc/dns/net/getaddrinfo.c b/libc/dns/net/getaddrinfo.c index 829b6791c..fd6c004c1 100644 --- a/libc/dns/net/getaddrinfo.c +++ b/libc/dns/net/getaddrinfo.c @@ -1290,6 +1290,17 @@ ip6_str2scopeid(char *scope, struct sockaddr_in6 *sin6, u_int32_t *scopeid) static const char AskedForGot[] = "gethostby*.getanswer: asked for \"%s\", got \"%s\""; +#define BOUNDED_INCR(x) \ + do { \ + BOUNDS_CHECK(cp, x); \ + cp += (x); \ + } while (/*CONSTCOND*/0) + +#define BOUNDS_CHECK(ptr, count) \ + do { \ + if (eom - (ptr) < (count)) { h_errno = NO_RECOVERY; return NULL; } \ + } while (/*CONSTCOND*/0) + static struct addrinfo * getanswer(const querybuf *answer, int anslen, const char *qname, int qtype, const struct addrinfo *pai) @@ -1335,7 +1346,8 @@ getanswer(const querybuf *answer, int anslen, const char *qname, int qtype, qdcount = ntohs(hp->qdcount); bp = hostbuf; ep = hostbuf + sizeof hostbuf; - cp = answer->buf + HFIXEDSZ; + cp = answer->buf; + BOUNDED_INCR(HFIXEDSZ); if (qdcount != 1) { h_errno = NO_RECOVERY; return (NULL); @@ -1345,7 +1357,7 @@ getanswer(const querybuf *answer, int anslen, const char *qname, int qtype, h_errno = NO_RECOVERY; return (NULL); } - cp += n + QFIXEDSZ; + BOUNDED_INCR(n + QFIXEDSZ); if (qtype == T_A || qtype == T_AAAA || qtype == T_ANY) { /* res_send() has already verified that the query name is the * same as the one we sent; this just gets the expanded name @@ -1370,12 +1382,14 @@ getanswer(const querybuf *answer, int anslen, const char *qname, int qtype, continue; } cp += n; /* name */ + BOUNDS_CHECK(cp, 3 * INT16SZ + INT32SZ); type = _getshort(cp); cp += INT16SZ; /* type */ class = _getshort(cp); cp += INT16SZ + INT32SZ; /* class, TTL */ n = _getshort(cp); cp += INT16SZ; /* len */ + BOUNDS_CHECK(cp, n); if (class != C_IN) { /* XXX - debug? syslog? */ cp += n; diff --git a/libc/dns/net/gethnamaddr.c b/libc/dns/net/gethnamaddr.c index 42f0d0adf..75cb2b3c5 100644 --- a/libc/dns/net/gethnamaddr.c +++ b/libc/dns/net/gethnamaddr.c @@ -186,14 +186,13 @@ debugprintf(const char *msg, res_state res, ...) #define BOUNDED_INCR(x) \ do { \ + BOUNDS_CHECK(cp, x); \ cp += (x); \ - if (cp > eom) \ - goto no_recovery; \ } while (/*CONSTCOND*/0) #define BOUNDS_CHECK(ptr, count) \ do { \ - if ((ptr) + (count) > eom) \ + if (eom - (ptr) < (count)) \ goto no_recovery; \ } while (/*CONSTCOND*/0) |