chiark / gitweb /
SECURITY: pap_mailbox822: Properly check st from adns__findlabel_next
authorIan Jackson <ijackson@chiark.greenend.org.uk>
Wed, 23 Nov 2016 21:03:40 +0000 (21:03 +0000)
committerIan Jackson <ijackson@chiark.greenend.org.uk>
Tue, 26 May 2020 19:07:42 +0000 (20:07 +0100)
commit020d86e2eccc2dbdfa9dcca08ddb327cc7ca3ae2
treeac5bed56c8d8529928bb17c522d6647d036f9739
parent2f6e879e0fca1715d5c5946bcedb4f821ce64d77
SECURITY: pap_mailbox822: Properly check st from adns__findlabel_next

Without this, an uninitialised stack value can be used as the first
label length.  Depending on the circumstances, an attacker might be
able to trick adns into crashing the calling program, leaking aspects
of the contents of some of its memory, causing it to allocate lots of
memory, or perhaps overrunning a buffer.

This is only possible with applications which make non-raw queries for
SOA or RP records.

Found by AFL 2.35b.  CVE-2017-9103.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>
src/types.c