chiark / gitweb /
SECURITY: pap_mailbox822: Properly check st from adns__findlabel_next
authorIan Jackson <ijackson@chiark.greenend.org.uk>
Wed, 23 Nov 2016 21:03:40 +0000 (21:03 +0000)
committerIan Jackson <ijackson@chiark.greenend.org.uk>
Tue, 26 May 2020 19:07:42 +0000 (20:07 +0100)
Without this, an uninitialised stack value can be used as the first
label length.  Depending on the circumstances, an attacker might be
able to trick adns into crashing the calling program, leaking aspects
of the contents of some of its memory, causing it to allocate lots of
memory, or perhaps overrunning a buffer.

This is only possible with applications which make non-raw queries for
SOA or RP records.

Found by AFL 2.35b.  CVE-2017-9103.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

No differences found