tree c29d1d66fcde06463d6c9212d799ffa451999711
parent bc552102ad0ba14eaf83a93a5119f316fa6481f5
author Remi Gacogne <remi.gacogne@powerdns.com> 1544029196 +0100
committer Willy Tarreau <w@1wt.eu> 1544622292 +0100
encoding latin1

BUG: dns: Fix off-by-one write in dns_validate_dns_response()

The maximum number of bytes in a DNS name is indeed 255, but we
need to allocate one more byte for the NULL-terminating byte.
Otherwise dns_read_name() might return 255 for a very long name,
causing dns_validate_dns_response() to write a NULL value one
byte after the end of the buffer:

dns_answer_record->name[len] = 0;

The next fields in the struct being filled from the content of the
query, it might have been possible to fill them with non-0 values,
causing for example a strlen() of the name to read past the end of
the struct and access unintended parts of the memory, possibly
leading to a crash.

To be backported to 1.8, probably also 1.7.